On this page:
The AppDynamics Controller can use an external Security Assertion Markup Language (SAML) identity provider (IDP) to authenticate and authorize users.
This page describes how SAML authentication works with AppDynamics. For instructions to set up SAML authentication, see Basic SAML Authentication Configuration.
Supported Identity Providers
AppDynamics certifies support for the following identity providers (IDPs):
- Ping Identity
- Azure AD
- IBM Cloud Identity
- Active Directory Federation Service (AD FS)
Other IDPs supporting HTTP POST binding should also be compatible with AppDynamics SAML authentication. If you are having issues setting up SAML with your IDP, contact your AppDynamics account representative for help.
AppDynamics supports identity federation with SAML 2.0, an open standard used by many IDPs. This identity federation enables single sign-on (SSO) with HTTP POST binding for the SAML request and HTTP POST binding for the IDP response.
The bindings have the following requirements:
- HTTP is the required transport. Optionally, you can also configure HTTPS transport.
- The AppDynamics Controller uses HTTP POST for the authentication request to the identity provider for the sign-out message to the identity provider. The IDP also uses HTTP POST to return the response.
How SAML Authentication Works with AppDynamics
With SAML authentication enabled:
- You navigate to the Controller login page and enter your account name.
- The Controller redirects you to the external SAML IDP.
- From the IDP, you enter your credentials.
- The IDP redirects and logs you into the Controller.
To log in to the Controller UI, users require access to both the Controller and the identity provider service through the network from their computer. You can configure the Controller to assign roles to authenticated users based on group attributes in their SAML responses. See Map SAML-Authenticated Users to AppDynamics Roles to learn about mapping SAML attribute to roles.
Who Can Configure SAML
Only users assigned to the AppDynamics role Account Owner can configure SAML authentication in the Controller and assign other users to the Account Owners role. Roles govern user privileges in the Controller UI. For more information on roles, see Roles and Permissions.