Knowledge Base

Yes

Environment

This document describes the new user login procedure when using both SAML and Active Directory together.

Before using SAML integration, a user account with an email address must exist in the App Control console for the integration to work.

This could be done by either:

Set up the user manually under the Login Accounts menu
Log in using an Active Directory account first which will sync the email address using the account attributes from AD
Import a list of user using the API

If the user account doesn't already exist when you attempt a SAML login, the login will fail
If the email address in Active Directory is different than the email sent in the SAML assertion, the login will fail

For example, the login will fail if the AD user email was:

"FirstNameLastName@domain.local", but the SAML email was "FirstNameLastName@domain.com"