SAML Configuration

1. Navigate to the EMS Platform admin page and sign in using Everyday User credentials assigned with the web administrator role:

   • On Prem customers: http(s)://servername/EMSPlatform/admin

   • Cloud customers: https://<customer>.emscloudservice.com/platform/admin

2. Click the SAML pane.

3. Enter your identity provider metadata URL in URL, or to upload XML, click Choose file.

4. Click Save Changes.

   This registers the metadata and generates the Auth Keys on the AUTH KEYS pane.

5. The EMS SAML SP metadata should now be available at:

   • On Prem customers: http(s)://servername/EMSPlatform/api/v1/authentication/saml/metadata/sp

   • Cloud customers: https:<customer>.emscloudservice.com/platform/api/v1/authentication/saml/metadata/sp

If you are using a metadata URL, there is a daily metadata sync that regenerates new auth keys dynamically when they expire. This does not apply if imported via XML. Auth keys must be manually regenerated if you are using the XML file upload.

If you modify any fields on this page such as sign auth requests to a value different than what is supplied by the metadata, the value in EMS reverts to match the metadata during the daily metadata sync when using the metadata URL.

EMS defaults to using the Name ID attribute in the SAML response as set in the User Identity field. For Azure AD, the Name ID attribute is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name.

Change the Name ID attribute:

1. From the User Identity dropdown, select Attribute.

2. In Identity Attribute Name, enter the name of the attribute included in the SAML response to use for authentication.

3. Click Save Changes.

You must follow optional steps if signed SAML requests are received.

1. Navigate to the EMS Platform admin page and sign in using Web Administrator Everyday User credentials.

2. Click the AUTH KEYS pane.

3. Click New Auth Key.

4. Set Purpose to SAML Service Provider.

5. Enable Auto-Generate Keys.

6. Click Save Auth Key.

Optionally, on the SAML pane in EMS Platform, you can enable Allow user to auto-create. When this is enabled, if a user successfully authenticates with your identity provider via SAML in EMS Web App but an everyday user account with their email address does not exist in EMS, one is automatically created using the default security template and status for new users parameter settings and process templates enabled as available for new users.

If you are using HR Toolkit to manage your everyday users, you must not enable this. Once you enable this setting, you can map SAML Attributes from your IDP to the following fields in EMS:

• Name – required

• Email Address – required

• Network ID – optional

• Phone – optional

• Fax – optional

The format and names of the SAML Attributes depend on your IDP, for example, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress for email address.

You can enable SAML sign in from the EMS Web App home page.

1. Navigate to the EMS Platform admin page and sign in using Web Administrator Everyday User credentials.

2. Click the Integrations pane.

3. Click EMS Web Application in the Clients page.

4. Set Everyday User Authentication Method to SAML.

5. Click Save Changes.

6. Sign in to the EMS Desktop Client as an admin user.

7. Navigate to System Administration > Settings > Parameters.

8. Select Everyday User Applications tab.

9. Set Use SAML 2.0 Authentication for User Authentication Web App Only parameter to Yes.

10. On Prem customers must recycle IIS app pool.
    

Cloud customers might have to wait up to 24 hours for this change to take effect.