Basic SAML Configuration - multiple Identifiers

Question

Basic SAML Configuration - multiple Identifiers

Mlekusch Jan 21

Hi
until a few weeks ago, we could have more than one Identifier (Entity ID) in de Basic SAML Configuration.
There is a button, that allows to add an additional identifier, but it won't let me save it.

How to add additional Identifiers. We have 13 different hosts, which uses all the same Configuration. But each of them sends an hardcoded url, based on the hostname.
it worked until a few weeks ago

thanks

Accepted answer

0 additional answers

Your answer

Answer 1

AmanpreetSingh-MSFT 56,841 Moderator

Hi @Mlekusch Jan • Thank you for reaching out.

You can add multiple Identifiers to an application only when the Sign on URL is specified. If the Sign-on URL is empty, it uses IDP-Initiated flow, which supports only one Identifier per application but when you add a URL to the Sign-on URL text box, the application uses SP-Initiated flow which supports multiple Identifiers per application. In the past, where you added multiple Identifiers, you must have a Sign-on URL specified.

So, to add multiple Identifiers you need to add a Sign-on URL, as shown below:

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Mlekusch Jan 21 Reputation points

2022-05-04T14:32:25.15+00:00

thanks, that works
We use now an url, which is not available, with that it works.
i'm not understand, what does this sign on url do.
AmanpreetSingh-MSFT 56,841 Reputation points Moderator

2022-05-05T02:46:43.643+00:00
Hi @Mlekusch Jan • The Sign-on URL enables support for SP Initiated login flow. If you don't specify the Sign on URL, only IDP initiated flow is supported.

SP initiated: You access the application using the Sign-on URL. This is where the login flow can be initiated and you get redirected to the Identity Provider (IDP) for authentication.

IDP initiated: The login flow is initiated directly from the Identity Provider and after the authentication is completed, you get redirected to the Reply URL (Assertion Consumer Service URL) for the application to consume the token.

Hope this clarifies the use of sign-on URL.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
AmanpreetSingh-MSFT 56,841 Reputation points Moderator

2022-05-06T03:18:57.83+00:00

Hi @Mlekusch Jan • Just checking if you have any further questions.
Leijen, Erik 0 Reputation points

2023-07-04T13:50:13.3566667+00:00

Thank you very much, this is very helpful for me.

I do have an extended versions of this challenge.

We have Application with multiple servers via GeoIP loadbalancing ApplicationEU,ApplicationUS & ApplicationIN.

Sign on URL will be application.acme.com and SAML will be configured for the three Entity ID's Application EU/IN/US.

Now we have a complication that some users require direct access to any of those applications and thus they will connect to (as example) applicationEU.acme.com.

Is there a way we can facilitate both Main URL as also the application specific URL's?

Our setup is SP initiated, so users either use the main or the location specific URL.

Your feedback is much appreciated.

Share via

Basic SAML Configuration - multiple Identifiers

0 additional answers

Your answer