This page provides an overview of Security Assertion Markup Language (SAML) authentication for Cisco AppDynamicsSaaS deployments.

The Cisco AppDynamics Controller can use the Cisco Customer Identity or an external SAML identity provider (IdP) to authenticate and authorize users. The Cisco Customer Identity will enable users to reuse an existing Cisco Identity and redirect them to the Cisco Identity Provider (IdP) when signing in.

For instructions to set up SAML authentication, see Configure Basic SAML for SaaS Authentication. 

Supported Identity Providers

Cisco AppDynamics certifies support for the following identity providers (IdPs):

  • Okta
  • Onelogin
  • Ping Identity
  • Azure AD
  • IBM Cloud Identity
  • Active Directory Federation Service (AD FS)

Other IdPs supporting HTTP POST binding should also be compatible with Cisco AppDynamics SAML authentication. If you are having issues setting up SAML with your IdP, contact your Cisco AppDynamics account representative for help.

Binding Support

Cisco AppDynamics supports identity federation with SAML 2.0, an open standard used by many IdPs. This identity federation enables single sign-on (SSO) with HTTP POST binding for the SAML request and HTTP POST binding for the IdP response.

The bindings have the following requirements:

  • HTTP is the required transport. Optionally, you can also configure HTTPS transport.
  • The Cisco AppDynamics Controller Tenant uses HTTP GET or POST for the authentication request to the identity provider for the sign-out message to the identity provider. The IdP also uses HTTP GET and POST to return the response.

How SAML Authentication Works with Cisco AppDynamics

With SAML authentication enabled:

  1. You navigate to the Controller Tenant login page and enter your account name.
  2. The Controller Tenant redirects you to the external SAML IdP.
  3. From the IdP, you enter your credentials.
  4. The IdP redirects and logs you into the Controller Tenant. 

To log in to the SaaS Controller Tenant UI, users require access to both the Controller Tenant and the IdP service through the network from their computer. You can configure the Controller Tenant to assign roles to authenticated users based on group attributes in their SAML responses. See Map SAML-Authenticated Users to AppDynamics Roles.

Who Can Configure SAML 

Only users assigned to the Cisco AppDynamics role Account Owner can configure SAML authentication in the Controller Tenant and assign other users to the Account Owner role. Roles govern user privileges in the Controller Tenant UI. See Manage Custom Roles for Cisco AppDynamics.