Configuring SSO Settings
Veeam Backup for AWS supports single sign-on (SSO) authentication based on the SAML 2.0 protocol. SSO authentication scheme allows a user to log in to different software systems with the same credentials using the identity provider service.
To configure SSO settings for Veeam Backup for AWS, do the following:
- Switch to the Configuration page.
- Navigate to General > Identity Provider.
- In the Identity Provider Configuration section, import identity provider settings from a file obtained from your identity provider:
- Click Upload Metadata.
- In the Upload Identity Provider Configuration window, click Browse to locate the file with the identity provider settings.
- Click Upload.
- Forward the service provider authentication settings to the identity provider — to obtain the settings, in theVeeam Backup for AWS Configuration section, click Download. Veeam Backup for AWS will download a metadata file with the service provider authentication settings to your local machine.
Alternatively, you can copy the service provider settings manually:
- Click Copy Link in the SP Entity ID / Issuer field.
- Click Copy Link in the Assertion Consumer URL field.
- [Optional] If you want to sign and encrypt authentication requests sent from Veeam Backup for AWS to the identity provider, select a certificate with a private key that will be used to sign and encrypt the requests:
- In theVeeam Backup for AWS Configuration section, click Select in the Certificate field.
- In the Upload Veeam Backup certificate window, click Browse to locate the certificate file. In the Password field, specify a password used to open the file.
- Click Upload.
Only .PFX and .P12 certificate files are supported.
After you configure SSO settings, you can add user accounts that will be able to log in to Veeam Backup for AWS using single sign-on. For more information, see Adding User Accounts.
To authenticate a user whose identity has been received from the identity provider, Veeam Backup for AWS redirects the user to the identity provider portal. After the user logs in to the portal, the identity provider sends a SAML authentication response to Veeam Backup for AWS. The SAML response must contain the UserName attribute to allow Veeam Backup for AWS to identify the user. The attribute value must match the user name that you specify when creating the user account.
If your identity provider does not send the UserName attribute by default, you must create a claim rule on the identity provider side to send this attribute in the SAML authentication response to the Veeam Backup for AWS request.