SAML 2.0 Authentication

ServiceDesk Plus Cloud offers support for SAML 2.0, which facilitates integration with federated identity management solutions for user authentication. ServiceDesk Plus Cloud acts as the SAML Service Provider (SP) and it integrates with SAML Identity Providers (IdP). The integration involves supplying details about SP to IdP and vice-versa. Once you integrate ServiceDesk Plus with an IdP, users can log in to ServiceDesk Plus Cloud from the respective identity providers GUI without supplying credentials. For example, you can set up Active Directory Federation Service (ADFS) as the IdP to allow your users to log in to ServiceDesk Plus Cloud with their Active Directory credentials.

How does SAML for ServiceDesk Plus cloud help you?

1) Facilitate easy and secure access for users to their IT help desk using Active Directory integration/LDAP Authentication

2) Help IT authenticate users and control application access centrally

3) Reduce password maintenance and security overheads for managing help desk users
 

How to enable SAML Authentication in ManageEngine ServiceDesk Plus cloud?

Organization Admins can enable SAML Authentication for their organizations. The following are the steps to enable SAML Authentication :

1. Domain verification

2. Subdomain or Custom domain configuration

3. Identity Provider installation

4. SAML Configuration

1. Domain Verification

Your organization could be using multiple domain names for various URLs and email addresses, depending on business needs.

For example, the ACME company could own and use acmebuilders.com, acmeproperties.com, acmesecurities.com, etc. all belonging to the same organization. You can configure all such domains used by your business and also verify that you indeed own those domains with ServiceDesk Plus. Once verified, users with email ids from those domains can be added to ServiceDesk Plus without invitation and verification.

2. Subdomain (Default URL) or Custom domain (Custom URL) Configuration

You can access ServiceDesk Plus cloud using your own customized domain URL (e.g., helpdesk.zylker.com) or a subdomain to sdpondemand.manageengine.com

To perform SAML Authentication, you must have configured a subdomain or a custom domain. This can be done from ESM Directory>>ESM Portal. When you configure a custom domain, make sure you add a CName alias and it points to customer-sdpondemand.manageengine.com 

3. Identity Provider Installation

You can install SAML 2.0 compliant identity provider on your network. All authentication requests will be forwarded to this Identity Provider. The Identity Provider can perform Active Directory/LDAP/custom Authentication and once the user is authenticated, the Identity Provider will redirect the browser with a response to accounts.zoho.com

We have tested SAML Authentication with AD FS 2.0 and AD FS 3.0 as Identity Provider.

The following pages contain steps for installing & configuring Active Directory Federation Services.

Click here to view the steps for installing and configuring AD FS 3.0.

If you are using any other SAML 2.0 compliant Identity Provider :

The authentication request sent from Zoho can be found here
The expected assertion response can be found here

4. SAML Configuration

For SAML Authentication, the login and logout requests will be redirected to the Identity Provider installed in your network. You need to specify the identity provider's login URL & logout URL so that requests will be redirected accordingly.  You also need to give the algorithm and the public key certificate of the Identity Provider so that Zoho / ManageEngine will decrypt the SAML responses sent by the identity provider. 

Once all the above steps are done, when your organization users access ServiceDesk Plus cloud using your configured subdomain or a custom domain (e.g., http://helpdesk.zylker.com),  they will be redirected to the Identity provider installed inside your network for authentication. Once the Authentication succeeds, they will then be redirected to ServiceDesk Plus cloud website and logged in.

SAML Authentication Request

Assuming zylker.com is the verified domain and idp-w2k8 is the system where the Identity Provider is installed.

Expected SAML Response

Assuming zylker.com is the verified domain,
The Assertion Consumer Service URL is : https://accounts.zoho.com/signin/samlsp/<orgid>
e.g., https://accounts.zoho.com/signin/samlsp/90000000000