To add an IdP to your Cloud Platform organization:

• Confirm that Federated Authentication is available to your Cloud Platform organization.
• Submit information from your IdP.
• Register your Cloud Platform organization with your IdP.
• Enable Federated Authentication.
• Implement the workaround for using Federated Authentication with Acquia CLI.

Part 1: Confirm that Federated Authentication is available to your Cloud Platform organization

• Confirm with your Account Manager that Acquia has enabled Federated Authentication for the Cloud Platform organization that you want to protect.
• Sign in to the Cloud Platform user interface with the user account that owns the organization or as a user with the Admin role for that organization.
• Select Manage.
• Select the organization you want to change.
• In the left navigation pane, select Security.

• Verify if you can see the Register an IDP option. The system displays this option if Federated Authentication is enabled for your account. If you do not see the Register an IDP option, contact your account manager.

Part 2: Submit information from your IdP

• After you complete the earlier steps, click Register an Identity Provider and specify the following information:
• In Label, specify a human-readable name for the IdP configuration.

• In Entity ID, specify the entity ID that you obtain from your IdP.

  Note

  If you integrate multiple Cloud Platform organizations with your IdP, you must have a unique entity ID for each organization. Therefore, you might need to set up a new application within your IdP where each application has a unique entity ID.

• In SSO URL, specify the URL that you obtain from your IdP. Every IdP structures its SSO URL differently. Ensure that this URL uses the SP-initiated SSO method.
• In Public Certificate, paste the public certificate of your IdP in the PEM format.
• Select Submit.

Part 3: Register your Cloud Platform organization with your IdP

After you complete these steps, the Cloud Platform user interface displays a summary of the information that you must provide to your IdP. Do not forget to update any dummy values you provided while specifying IdP details in Cloud Platform. To update these values, select Edit.

• To register with your IdP, provide the entity ID of Cloud Platform and your IdP’s ACS link.

  Cloud Platform uses the information provided in Part 2 to generate an ACS link specific to your IdP.
• If you specified dummy values in Entity ID or SSO URL in the previous section, update these fields with the values provided by the IdP.
• Ensure that your IdP is configured with the following:
  • The response from your IdP and the assertion within the response must be signed. If not, validation fails. Your IdP must have ds:Signature... as a child of <saml:Assertion….
  • Ensure that your IdP sends the RelayState to Cloud Platform.

Part 4: Enable Federated Authentication

• After completing these steps, select Enable.

  Cloud Platform displays a confirmation dialog box.

• Select the confirmation checkbox and select Enable.

  The Cloud Platform user interface displays a confirmation window indicating that your IdP is enabled.

  After Federated Authentication is enabled, you and your users must authenticate with your external IdP when you access the Cloud Platform organization.

Setting up Federated Authentication