Settings - SAML Setup

Overview

There are multiple ways that a Tulip account can be configured to work with an external identity provider. These options are detailed on the Enterprise Authentication page.

If a Tulip account is configured by a Tulip engineer to utilize a SAML directory for both authentication and authorization of users (called SAML Control Mode), then a user with the Account Owner role will need to use this page to determine which SAML attributes will map to certain Tulip user properties.

This must be done before SAML users are able to successfully log in to Tulip.

Model/Page Connections

User

Create

• This interface allows you authenticate and authorize users in Tulip as soon as they log in with their SAML credentials. All user attributes will be determined by the mapping of SAML attributes to user properties in this interface.

Pages

This page can be accessed from:

• Settings: Account

User Permissions

Only users with "Account Owner" permissions can access this interface.

Account Settings Configuration

NOTE: SAML configuration settings only available with the samlConfigUI set to True

Enable SAML Logins - When toggled, users will be prompted to login through SSO provider when authenticating.

Identity Provider Configuration

Upload Identity Provider Metadata XML - Automatically fill the remaining fields based on a provider supplied metadata file.

Authentication Options

Configure where and how users authenticate on your instance.

Attribute Mapping

Configure how you want to map your SAML user attributes to Tulip user profile fields.

Role Mapping

Configure what level of access in Tulip users should be given based on their SAML attributes.

Options:

• Tulip Default Role Mapping - All users will be assigned this role when they log in.
• Custom Role Mapping - Use your SAML attributes to determine what role to assign users when they log in.

If Custom Role Mapping has been selected:

• The SAML attribute containing role should be entered.
• Each value for the role attribute, and it's associated Tulip role should be mapped.

Workspace Mapping

Configure which workspace users should be placed in based on their SAML attributes. Note: Users who are assigned the Account Owner role have access to all workspaces. These users are not required to have any workspace-mapping SAML attributes.

Options:

• Tulip Default Workspace Mapping - All users will be placed in this workspace when they log in.
• Custom Workspace Mapping - Use your SAML attributes to determine what workspace to place users in when they log in.

If Custom Role Workspace has been selected:

• The SAML attribute containing Workspace should be entered.
• Each value for the workspace attribute, and it's associated Tulip Workspace should be mapped.

Access Control

Restrict access to Tulip based on SAML attributes.

Options:

• Access Attribute Optional - If a user does not have this SAML attribute, they will not be allowed to log in to Tulip. If left blank, any user in your organization will be allowed to log in to Tulip (as long as they have a role and workspace).
• Access Value Optional - If a user does not have the access attribute set to this value, they will not be allowed to log in to Tulip. If left blank, users may have any value in the attribute.

Attribute Update Behavior

Options:

• Tulip Control Mode - Users' Tulip role and workspace will only be updated from the IdP the first time they log in to Tulip. Users who are deactivated in Tulip will not be allowed to log in.
• Identity Provider Control Mode - Users' Tulip role and workspace will be updated from the IdP every time they log in to Tulip. Users who are deactivated in Tulip will be automatically reactivated if they successfully authenticate with the IdP.

Customization

Login Button Label Optional - Label shown on the SAML login button on Tulip login pages.

Tests

Requirements