Multiple SAML configurations

3 replies
28 views

Here is the scenario:

1) We have 2 different Appian applications running on the same instance
2) Our organization policy requires us to have a SAML configuration per application, so we have 2
3) Each of these SAML configurations is configured to "Create new users upon sign in"
4) The SSO Team passes the application name in the SAML attributes

Appian displays the sign-in page and prompts the user to select the SAML configuration to use. We created Authentication Group rules to put someone in the group associated with the SAML config according to the attribute described in #4 above, but it does not work. The user gets 401 Unauthorized.

saml

N

nareshs945

Inspiring

I think the problem is with how Appian identifies the SAML provider during login. The application name sent in the SAML attributes is available only after the user has been redirected to the IdP, so it cannot be used to decide which SAML configuration Appian should use initially.

I would try giving both SAML configurations different Web Address Identifiers and using the corresponding `?signin=` URL (ex: ?signin=appA or signin=appB) to route users to the right provider. I would also double-check the Authentication Group assigned to each configuration, since Appian returns 401 if the user is not a member of the group associated with the selected provider.

One more thing to check is whether users belong to both SAML Authentication Groups. Appian uses IdP ordering when a user belongs to multiple groups, which could cause the wrong provider to be selected.

see here for additional information
https://docs.appian.com/suite/help/26.6/SAML_for_Single_Sign-On.html