Configuring SSO Settings
Veeam Backup for Microsoft Azure supports single sign-on (SSO) authentication based on the SAML 2.0 protocol. SSO authentication scheme allows a user to log in to different software systems with the same credentials using the identity provider service.
To configure SSO settings for Veeam Backup for Microsoft Azure, complete the following steps:
- Switch to the Configuration page.
- Navigate to Settings > Identity Provider.
- In the Identity Provider Configuration section, import identity provider settings from a file obtained from your identity provider:
- Click Upload Metadata.
- In the Upload Identity Provider Configuration window, click Browse to locate the file with identity provider settings.
- Click Upload to import the metadata.
- To finish SSO settings configuration, you must pass the service provider authentication settings to the identity provider. To obtain the settings, in the Veeam Backup for Microsoft Azure Configuration section, click Download. Veeam Backup for Microsoft Azure will download a metadata file with the service provider authentication settings to your local machine. Alternatively, you can copy the service provider settings manually:
- Click Copy Link to the right of SP Entity ID / Issuer.
- Click Copy Link to the right of Assertion Consumer URL.
If you want to sign and encrypt authentication requests sent from Veeam Backup for Microsoft Azure to the identity provider, you must select a certificate with a private key that will be used for encryption and signing:
After you configure SSO settings, you can add user accounts that will be able to log in to Veeam Backup for Microsoft Azure using single sign-on. For more information, see Adding User Accounts.
To authenticate a user whose identity has been received from the identity provider, Veeam Backup for Microsoft Azure redirects the user to the identity provider portal. After the user logs in to the portal, the identity provider sends a SAML authentication response to Veeam Backup for Microsoft Azure. The SAML response must contain the user.userprincipalname attribute to allow Veeam Backup for Microsoft Azure to identify the user. That is why, if your identity provider does not send the user.userprincipalname attribute by default, you must create a claim rule on the identity provider side to send this attribute in the SAML authentication response to the Veeam Backup for Microsoft Azure request.