Managing Identity Providers

Veeam ONE allows you to create and manage identity provider configurations to set up single sign-on (SSO) using SAML.

To configure identity providers, you must have the Veeam ONE Administrator role, and the administrator role on the relevant identity provider platform.

Adding Identity Providers

You can add identity providers (IdP) to allow users to log in to Veeam ONE using external authentication services. SAML authentication requires a service provider (SP) to set up a trust relationship with an identity provider (IdP). To do that, you must create an IdP configuration in Veeam ONE.

To add an identity provider:

1. Open Veeam ONE Web Client.

For details, see Accessing Veeam ONE Components.

2. At the top right corner of the Veeam ONE Web Client window, click Configuration.
3. In the configuration menu on the left, click Access Management.
4. On the Identity Providers tab, click Add to open the Add Identity Provider wizard.
5. At the Provider Info step of the wizard, define:

• Identity Provider Settings:

• Display name — specify a friendly name that will be displayed for this identity provider in Veeam ONE.
• Identity provider URL — specify the metadata URL of the identity provider that will be used to retrieve its SAML configuration. The URL must use HTTPS.
• Entity ID — optional. Specify the unique ID of the identity provider. It is required if the identity provider metadata describes more than one entity, or if the provider does not publish its entity ID in its metadata. If you are not sure, leave this field blank and run Test Login. If the configuration cannot be loaded, specify the entity ID and resync the configuration.

• Veeam ONE Settings:

• Client ID — specify the name of the client created for Veeam ONE on the identity provider side. The SP entity ID URL and Assertion consumer URL are derived from the Client ID and remain empty until you enter it.
• SP entity ID URL — a read-only URL that Veeam ONE generates to identify itself as a service provider to the identity provider. You can copy it to configure the identity provider.

• Assertion consumer URL — a read-only URL that Veeam ONE generates as the endpoint where the identity provider sends authentication responses. You can copy it to configure the identity provider.

6. At the Settings step of the Add Identity Provider wizard, specify the following:

• Service Provider Settings — specify the following, or click Reset to default to restore the default values:

• Outbound signing algorithm — select from SHA256, SHA384 or SHA512.
• Minimum accepted incoming signing algorithm — select from SHA256, SHA384 or SHA512.

• Authentication Parameters — select the Configure authentication parameters check box to specify:

• Comparison method — the rule the identity provider applies when matching the authentication it performed against the requested Context class. Select from Exact, Minimum, Maximum or Better.

• Context class — the SAML authentication context the identity provider must satisfy. Select a value from the list. For details on each value, see the SAML 2.0 authentication context specification.

7. At the Security Configuration step of the wizard, select either of the following options for a security certificate that will be used by Veeam ONE to connect to the IdP:

• Generate a self-signed certificate — Veeam ONE generates a new self-signed certificate automatically.
• Use the selected security certificate — upload a certificate in the PKCS#12 format from your local disk or file share and provide the certificate password if the file is password-protected. The certificate file must have the .PFX or .P12 extension.

8. At the Summary step of the wizard, review the configuration settings and click Finish.

Completing the Setup

When you click Finish, Veeam ONE adds the identity provider to the list with the Pending status. The identity provider is not available and does not appear on the login page until you complete the setup. Click the Pending status to view the configuration instructions.

To complete the setup:

1. Select your identity provider name from the Identity Provider Name list.
2. Select the Configuration drop down and click Download Metadata File to download the metadata file.
3. Import the metadata file into your identity provider.
4. Click Test Login to verify the configuration.

When the test succeeds, the identity provider changes to the Configured status and appears on the login page.

Identity Provider Statuses

On the Identity Providers tab, the Status column shows the current state of each identity provider:

• Configured — the identity provider is set up and available for sign-in.
• Pending — the setup is not complete, and the identity provider is not yet available.
• Failed — the identity provider configuration has an error.
• Disabled — the identity provider is turned off.

For identity providers with the Pending or Failed status, click the status to open a dialog with the setup instructions or the reason for the failure.

Editing Identity Providers

You can edit an existing identity provider to change its configuration.

To edit an identity provider:

1. Open Veeam ONE Web Client.

For details, see Accessing Veeam ONE Components.

2. At the top right corner of the Veeam ONE Web Client window, click Configuration.
3. In the configuration menu on the left, click Access Management.
4. On the Identity Providers tab, select the identity provider you want to edit.
5. Click Edit.
6. In the Edit Identity Provider wizard, change the settings as required and click Finish.

When you edit an identity provider, the Security Configuration step offers a third option, Use the existing security certificate, which is selected by default and keeps the certificate that is currently in use.

Removing Identity Providers

You can remove identity providers configured in Veeam ONE. Note that when you remove an identity provider, all users and groups mapped to it are removed together with the provider. There is no remapping — you must create them again after you re-add the provider.

To remove an identity provider:

1. Open Veeam ONE Web Client.

For details, see Accessing Veeam ONE Components.

2. At the top right corner of the Veeam ONE Web Client window, click Configuration.
3. In the configuration menu on the left, click Access Management.
4. On the Identity Providers tab, select one or more identity providers you want to remove.
5. Click Remove.

Updating Identity Provider Configuration

You can update an identity provider configuration in Veeam ONE. This can be useful if changes were applied to the identity provider server and you must update the Veeam ONE configuration with these changes. You can also download configuration metadata to troubleshoot issues.

To update an identity provider configuration:

1. Open Veeam ONE Web Client.

For details, see Accessing Veeam ONE Components.

2. At the top right corner of the Veeam ONE Web Client window, click Configuration.
3. In the configuration menu on the left, click Access Management.
4. On the Identity Providers tab, select the identity provider whose configuration you want to update.
5. From the Configuration drop-down list, select Resync Configuration.
6. [Optional] From the Configuration drop-down list, select Download Metadata File to save the metadata file.
7. [Optional] From the Configuration drop-down list, select Test Login to test the updated configuration.

Enabling or Disabling Identity Providers

You can temporarily disable an identity provider when required for maintenance or troubleshooting, and re-enable it when ready. To enable or disable an identity provider:

1. Open Veeam ONE Web Client.

For details, see Accessing Veeam ONE Components.

2. At the top right corner of the Veeam ONE Web Client window, click Configuration.
3. In the configuration menu on the left, click Access Management.
4. On the Identity Providers tab, select one or more identity providers you want to enable or disable.
5. Click Enable or Disable.