You have the possibility to enable unified sign-on and authentication (SSO) to access
Talend Administration Center through different Identity Provider systems (IdP) and to manage the roles and project
types of the application users using the IdPs. For more information on IdP
configuration, see:
If SSO has not been enabled yet, select true in the
Use SSO Login field.
Information noteNote: If Personal Access Token is enabled, when SSO is enabled or disabled, all
users' Personal Access Token will be reset. For more information, see Setting up the Security Policy.
Click Launch Upload in the IDP
metadata field and upload the Identity Provider metadata file
you have previously downloaded from the Identity Provider system.
When the metadata contains these values, Talend Administration Center fills in the single sign-on service URL and the Single Logout Service URL field automatically.
If the metadata contains one logout service, Talend Administration Center uses it. If the metadata contains multiple logout services, Talend Administration Center prompts you to choose which service to use.
If you already entered values manually, review them after importing the metadata. Talend Administration Center does not overwrite existing manual values silently.
In the Service Provider Entity ID field, enter the
Entity ID of your Service Provider (available in the configuration of the IdP),
for example,
http://localhost:8080/org.talend.administrator/ssologin.
In the IDP Authentication Plugin list, select the Identity
Provider from Okta, ADFS,
ADFS3, ADFS4,
PingFederate, SiteMinder,
Custom plugin and Keycloak.
If Custom plugin is selected, a Upload IDP
Authentication Plugin dialog box will be shown prompting you to upload
the custom Identity Provider metadata file. If you have enabled Personal Access
Token, you can use the Personal Access Token instead and skip the IDP Authentication
Plugin configuration.
If Keycloak is selected, follow step 5 of this link to enable Personal Access Token.
The jar files provided by Qlik
are located in the
<TomcatPath>/webapps/org.talend.administrator/idp/plugins
directory.
Information noteNote: If you are using Custom plugin for SSO, you need to modify the
<TomcatPath>\conf\server.xml file by changing the value
of autodeploy to false in the following code
block. Otherwise the custom IDP plugin will be deleted on Tomcat
restart.
Click Identity Provider Configuration and fill out the
required information.
Example
A sample PingFederate configuration:
Example
A sample Okta configuration:
Set the Use Role Mapping field to
true to map the application project types and the
user roles with those defined in the Identity Provider system.
Once you have defined project types/roles at the Identity Provider side, you
will not be able to edit them from Talend Administration Center.
Examples for project types:
DI = DI; DQ=DQ; NPA=NPA
Examples for roles:
Talend Administration Center Roles
Administrator = tac_admin
Operation Manager = tac_om
Information noteNote: Setting the Talend Administration Center roles is mandatory.
Talend Data Preparation Roles
Administrator = dp_admin
Data Preparator = dp_dp
Talend Data Stewardship Roles
Data Steward = tds_ds
Role Mappings attributes: in case of a security identifiers
list, you need to change the default value for SAML attribute name
(tac.role) to tokenGroups.
If your organization does not accept custom attributes in the SAML token, either:
Select Show Advanced Configuration in the wizard and,
in Path to Value, enter the XPath expression to target
the SAML value to map to the corresponding Talend Administration Center object (Project Types, Roles,
Email, First Name,
Last Name).
In this case, you cannot create users
manually, but the user type and the user roles can be edited in Talend Administration Center.
When users log in for the first time, their type is No Project
Access.
The project types and roles set in the Identity Provider override the roles set in
Talend Administration Center at
user login.
The default login timeout is set to 120 seconds, which you can change by
adding the parameter sso.config.clientLoginTimeout with the
desired timeout in the
<ApplicationPath>/WEB-INF/classes/configuration.properties
file.
In the Redirect URL on Logout field, enter the URL of the
identity provider page to open after users log out of Talend Administration Center.
If this field is empty, you will be redirected to the default location of
Talend Administration Center on logout.
This field controls the page opened in the browser after logout. It is different from the Single Logout Service URL field, which defines the identity provider endpoint used for SAML single logout.
In the Single Logout Service URL field, verify the logout endpoint imported from the identity provider metadata, or enter it manually if it is not provided.
If the metadata contains a Response Location value for the SingleLogoutService element, Talend Administration Center uses it. Otherwise, Talend Administration Center uses the Location value.
When SAML single logout is configured, Talend Administration Center supports IdP-initiated logout. When a user logs out from the identity provider, Talend Administration Center ends all active sessions for that user and returns a SAML LogoutResponse by using the binding declared in the identity provider metadata.
Did this page help you?
If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!
