Skip to main content Skip to complementary content

Configuring the SAML server in Talend Data Catalog

Before you begin

  • As an administrator, you have created and configured the SAML application in Okta.
  • As an administrator, you have set up the users and the user attributes of your application in Okta.
  • You have been assigned a global role with the Security Administration capability.

Procedure

  1. Go to MANAGE > Users.
  2. In the Authentication field of the toolbar, select SAML from the drop-down list.
  3. Click the Configure authentication icon next to the drop-down list.
  4. In the Connection tab, fill in the required information using the previously saved Identity Provider metadata.
    Field Action
    Identity Provider Enter the Identity Provider Issuer.
    X509 Certificate Enter the public X509 certificate of your identity provider.
    Binding Type
    Select the manner in which binding is accomplished:
    • HTTP-Redirect:

      Talend Data Catalog sends a SAML authentication request to the identity provider SSO service using the HTTP-Redirect Binding.

      Information noteNote: As Talend Data Catalog does not have the private key of the identity provider, the SAML authentication request sent by Talend Data Catalog is neither signed nor encrypted. Since the request usually does not contain much private data, there is little need to encrypt the SAML request.
    • HTTP-POST:

      The identity provider returns the SAML response to a Talend Data Catalog assertion consumer service using the HTTP-POST Binding.

      Information noteNote: As Talend Data Catalog does not have the private key of the identity provider, the SAML assertion received by Talend Data Catalog can be signed but not encrypted.

      To validate the signature, Talend Data Catalog only needs the identity provider’s public key. The assertion requires to be signed, so that Talend Data Catalog can verify that the assertion contents have not been altered in transit.
    Single Sign On URL

    Enter the Single-Sign On URL.
    Signature Element

    Select one of the values from the drop-down list to specify if the SAML authentication response message and SAML assertion are digitally signed by the identity provider or not.

    Talend Data Catalog will return an error message at the login time if an element is configured as signed but the element in the SAML response was not signed by the identity provider.

    If an element is configured as not signed, Talend Data Catalog will not validate the signature in that element even if it may have been signed by the identity provider.
  5. In the User Attribute Mapping tab, fill in the fields with the corresponding SAML attributes to retrieve the user information you have previously set in Okta.
  6. In the Group Mappings tab, map the group attribute from the external user account to the Talend Data Catalog group name.
    To enable the automatic group assignment, you can fill in the Groups attribute with the corresponding field name in the user account information. Talend Data Catalog uses the value of this field as the security group assignment.
    The user account information is returned from the SAML server to Talend Data Catalog after the SAML server validates an access token upon a login request.
    You can use the wildcard ("%") when configuring the group mappings. The % matches zero or more characters.
    When populating a SAML attribute for group assignment, you switch from native and manually managed group assignment to SAML driven and automatic group assignment for all SAML users. As a SAML user, you lose the previous native group assignment the next time you log in.

    When deleting the last SAML attribute for group assignment, you switch from SAML driven group assignment to native group assignment. Any SAML user will be associated with the Guest group, until the users are manually assigned to other groups.

  7. Save your changes.
  8. Reopen the browser and try to access Talend Data Catalog.

Results

You are redirected to Okta for authentication.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here