Single Sign-On

Purpose

The Single Sign-On page in the Admin Console enables you to configure single sign-on for users in your Appian environment.

Access

To access the Single Sign-On page, go to the Admin Console. Then, in the left navigation menu, under Authentication, click Single Sign-On.

Settings

Appian lets you set up one of three options for single sign-on (SSO) with an identity provider: OpenID Connect, PIEE, and SAML.

Each of these can optionally enforce a terms of service agreement for users as part of the sign-in flow. SSO flows can be used when users attempt to authenticate using Appian Mobile and when accessing Appian content through embedded interfaces.

SSO settings cannot be imported or exported from the Admin Console.

OpenID Connect

The OpenID Connect page allows you to configure Appian to authenticate users with OpenID Connect. OpenID Connect can be used to configure single sign-on.

See OpenID Connect User Authentication for an explanation of how to configure connections with OpenID Connect identity providers.

Terms of service agreement for OpenID Connect

The Terms of Service Agreement section on the OpenID Connect tab allows you to require users who authenticate through OpenID Connect to acknowledge a system use notification before accessing Appian.

The section contains the following fields:

• Require Users to Accept Terms of Service Before Access: Select this checkbox to show the terms of service for users who authenticate through OpenID Connect.
• Terms of Service: Enter the legal disclosure or system use notification text that users must acknowledge.

When the user's OIDC authentication is initiated by Appian, Appian displays the terms of service before redirecting the user to the identity provider. The user must click I AGREE before authentication proceeds. If a user's pre-authentication session times out, they are redirected back to the terms of service page after successful authentication, and both I AGREE and Logout options are displayed.

SAML authentication

The SAML Authentication page allows you to configure Appian to authenticate users against external SAML identity providers (IdP), like Microsoft ADFS or Shibboleth, rather than against Appian authentication.

Configuring SAML settings

See SAML for Single Sign-On for an explanation of the global and per-IdP settings, as well as instructions for how to add a SAML identity provider for users to authenticate against.

Terms of service agreement for SAML

The Terms of Service Agreement section on the SAML Authentication tab allows you to require users who authenticate through SAML to acknowledge a system use notification before accessing Appian.

The section contains the following fields:

• Require Users to Accept Terms of Service Before Access: Select this checkbox to show the terms of service for users who authenticate through SAML.
• Terms of Service: Enter the legal disclosure or system use notification text that users must acknowledge.

When the user's SAML authentication is initiated by Appian, Appian displays the terms of service before redirecting the user to the identity provider. The user must click I AGREE before authentication proceeds. If a user's pre-authentication session times out, they are redirected back to the terms of service page after successful authentication, and both I AGREE and Logout options are displayed.

When the user's SAML authentication is initiated by the identity provider, Appian displays the terms of service after authentication but before granting access to the application. The user must click I AGREE to establish a session, or click Logout to navigate away without gaining access.

When you update the terms of service text for SAML, Appian invalidates the Remember Me cookies associated with the SAML authentication protocol. Users must acknowledge the updated terms during their next sign-in. Remember Me cookies for other authentication protocols are not affected.

Verify My Access

The Verify My Access button only appears when you use SAML authentication to sign in to Appian. When it is visible, before you can save your changes, you must verify that you can still sign in. Clicking this button will attempt SP-initiated sign-in to your identity provider in a new tab. If you successfully sign-in, you will be able to save your changes.

Additional configuration details and notes

• It is not possible to configure Appian to allow a user to authenticate multiple ways. Each user can authenticate through one of the following:
  • A single identity provider.
  • Appian authentication.
  • LDAP.
• If a user is in multiple SAML authentication groups, the highest identity provider in the list takes precedence.
• Starting a process model as a web service requires using Appian authentication and is therefore not available to users who are configured to authenticate via SAML.
• SAML authentication settings cannot be imported or exported from the Admin Console.
• A user configured to authenticate using SAML cannot be used to call Appian web APIs.
• Only users in the OAuth 2.0 SAML Bearer Assertion Users system group will use the OAuth 2.0 SAML Bearer Assertion Flow.

Security

• Appian signs its assertions using the SHA-1 hashing algorithm. Some identity providers, such as Microsoft ADFS, require you to specify this when configuring it to integrate with Appian.
• Appian supports signed, encrypted SAML assertions up to the AES-256 standard. In order to make use of this capability, the environment must be running on an Appian Cloud instance. Otherwise, self-managed environments will need to be running OpenJDK 17.

PIEE authentication

The PIEE Authentication page allows you to configure Appian to authenticate users against the Procurement Integrated Enterprise Environment (PIEE). PIEE is the primary enterprise procure-to-pay (P2P) application for the Department of Defense and its supporting agencies. PIEE user authentication can be used for single sign-on to procurement-related systems.

See PIEE User Authentication for an explanation of how to configure PIEE authentication.

Terms of service agreement for PIEE

The Terms of Service Agreement section on the PIEE Authentication tab allows you to require users who authenticate through PIEE to acknowledge a system use notification before accessing Appian.

The section contains the following fields:

• Require Users to Accept Terms of Service Before Access: Select this checkbox to show the terms of service for users who authenticate through PIEE.
• Terms of Service: Enter the legal disclosure or system use notification text that users must acknowledge.

When the user's PIEE authentication is initiated by Appian, Appian displays the terms of service before redirecting the user to the identity provider. The user must click I AGREE before authentication proceeds. If a user's pre-authentication session times out, they are redirected back to the terms of service page after successful authentication, and both I AGREE and Logout options are displayed.

Feedback