Q: Q: How can I troubleshoot SSO failures?

A: You can view failures by issuing this API call: {api_endpoint} /api/v1/orgs/: {org_id} /ssos/: {sso_id} /failures You'll see the failure reason as well as the assertion that was received. To issue the API call, you'll need to replace the italicized, bracketed terms with the actual values. {api_endpoint} If you're unsure of your organization's API endpoint URL, you can derive it from your Juniper Mist portal URL. The portal URL starts with manage . The corresponding API endpoint URL replaces manage with api . Notice the bolded characters in the following examples. Portal URL manage.ac2.mist.com /admin/?org_id=xxxxxxx-xxxx-xxx Corresponding API Endpoint URL api.ac2.mist.com /admin/?org_id=xxxxxxx-xxxx-xxx {org_id} You also can find your organization ID in the Juniper Mist portal URL. The ID appears after the characters org_id= . Notice the bolded characters in the following example. Organization ID in Portal URL manage.ac2.mist.com/admin/?org_id= 12345678-1a2b-3456cdef-xyz123 {sso_id} To find your SSO ID, issue this API call: {api_endpoint} /api/v1/orgs/: {org_id} /ssos Look in the ID field to find your SSO ID.

Question 1

Q: What are the basics of Mist’s SSO implementation I should know?

Accepted Answer

A: Mist supports SAML2.0 based SSO in several parts of our product, with identical implementations. While this document is written for Admin SSO, we also support SSO for guest access, as well as PPSK self provisioning where the implementations are the same, except for the mandatory attributes. So this document can be applied to all of Mist’s SSOs.

A user account in Mist can be one of three types of accounts, based on how it authenticates to Mist; as a local account to Mist, and SSO account, or and OAUTH2 account. An account can only be one of those types. So an SSO account would always authenticate to Mist via the IdP (unless the user changes their account type).

Make sure to sign the IdP assertion and response and return the correct attributes in the assertion with correct capitalization of the attribute names.

Question 2

Q: What IdPs does Mist Support for SSO Access?

Accepted Answer

A: Mist supports any IdP that supports SAML2.0.

Question 3

Q: Does Mist support SP and IdP initiated SSO?

Accepted Answer

A: Yes, Mist supports both SP and IdP initiated SSO. With the caveat that the very first login for a SSO user to Mist must be IdP initiated. Please also note for SP initiated login the entity ID entered in the IdP must be the same as ACS URL.

Question 4

Q: What attributes do I need to send in my assertion?

Accepted Answer

A: These are the attributes Mist expects in the SAML assertion:

Note the capitalization is important.

NameID
Role
FirstName
LastName

NameID is required. Role is required except when you configure

default_role

via API. FirstName and LastName are recommended, or else you will see ? ? as the user’s first and last names.

Question 5

Q: What NameID formats do you support?

Accepted Answer

A: NameID is used as the unique identifier for the user. We support email and unspecified. Most people use email, but you can really send anything as long as you configure unspecified in the Mist SSO configuration. If you use unspecified, you can send us most anything, as long as it is unique and consistent. You will see we generate a unique ID for the user within Mist with unspecified.

Question 6

Q: What is a role used for?

Accepted Answer

A: Role is used to derive the permission the user should be granted. The role returned in the assertion would match to a Role in the Mist SSO Role config on the Org settings page. Please note the user permission is dynamically generated per SSO login.

Question 7

Q: Can I return multiple roles for a user?

Accepted Answer

A: Yes, if multiple roles are returned and matched, we will take the superset of the permissions. Please note, by default all roles must be matched, otherwise the user will be denied access. To allow partial matching of roles, there is an API option ignore_unmatched_roles. Alternatively, there is also an API option default_role, when no roles are matched.

We accept multiple roles in a variety of formats in the assertion. Multiple roles can be sent as comma separated, multiple AttributeValue pairs, or with CN parsing. Here are a few examples:

Comma-separated “Role” attributes

# parsed list of roles

Multiple “Role” attribute values pairs

# parsed list of roles

Combination of comma separated and multiple AV pairs

# parsed list of roles

Example of CN extraction – “role_attr_extraction”: “CN”,

# parsed list of roles

Question 8

Q: How can I troubleshoot SSO failures?

Accepted Answer

A: You can view failures by issuing this API call:{api_endpoint}/api/v1/orgs/:{org_id}/ssos/:{sso_id}/failures

You'll see the failure reason as well as the assertion that was received.

To issue the API call, you'll need to replace the italicized, bracketed terms with the actual values.

{api_endpoint}
If you're unsure of your organization's API endpoint URL, you can derive it from your Juniper Mist portal URL. The portal URL starts withmanage. The corresponding API endpoint URL replacesmanagewithapi. Notice the bolded characters in the following examples.
Portal URL
manage.ac2.mist.com/admin/?org_id=xxxxxxx-xxxx-xxx
Corresponding API Endpoint URL
api.ac2.mist.com/admin/?org_id=xxxxxxx-xxxx-xxx
{org_id}
You also can find your organization ID in the Juniper Mist portal URL. The ID appears after the charactersorg_id=. Notice the bolded characters in the following example.
Organization ID in Portal URL
manage.ac2.mist.com/admin/?org_id=12345678-1a2b-3456cdef-xyz123
{sso_id}
To find your SSO ID, issue this API call:{api_endpoint}/api/v1/orgs/:{org_id}/ssos
Look in the ID field to find your SSO ID.

Question 9

Q: Do I need to manually provision my SSO users within Mist?

Accepted Answer

A: No you don’t. Access for SSO users is granted on demand by your IdP. That is to say SSO users are authenticated by the IdP, not but Mist. The access level to the Mist Dashboard is controlled by the role attribute returned in the assertion matching to a role defined in Mist.

Question 10

Q: What is the first-time login process for my SSO users?

Accepted Answer

Give your SSO users your Mist organization's SSO URL for first-time login. This step is necessary for the first login only, to establish the account as an SSO account. After that, they can use the SSO URL or go to directly to the Juniper Mist portal (manage.mist.com). For more information about user setup with SSO, seeAdd Identity Providers and Users

Follow these steps to add identity providers (IdPs) to use to authenticate your portal users.

.

Question 11

Q: How do I know which SSO users have accessed my Org?

Accepted Answer

A: You would check the Audit Logs under the Organization tab. You would see a log similar to: Austin Powers austin@groovy.com Login with Role “Groove-Master”

Question 12

Q: Does Mist have a metadata file?

Accepted Answer

A: Yes, it can be found /api/v1/orgs/:org_id/ssos/:sso_id/metadata or /metadata.xml.

For example:

Question 13

Q: I need multiple SSOs in my Org. Does Mist Support that?

Accepted Answer

A: Yes, absolutely. Multiple SSOs within an Org are supported. Keep in mind, while an organization can have multiple SSOs, and a user can have permissions to multiple organizations, an SSO user in Mist can only “belong” to one SSO. This is typically most relevant when you have a “dev” and “production” SSO and use the same email for both.

Question 14

Q: I have multiple organizations, can I use SSO with multiple Orgs?

Accepted Answer

A: Yes, this is also possible. It can be handled in two ways. First you have a “home” Org where you have the SSO. Then you can manually invite users to your second Org. When they login they would see both Orgs listed. The second way is to use our MSP feature (which is a controlled access feature). Where you place the SSO at the MSP Level and based on the role returned, users would have access to the MSP, or just specific orgs in the MSP.

Question 15

Q: What happens when I delete an SSO within Mist?

Accepted Answer

A: When you delete an SSO, it will automatically delete all the user accounts within Mist associated with that SSO. This is particularly useful when migrating from one SSO to another, such as “dev” to “production.”

Question 16

Q: How do API tokens work with SSO users?

Accepted Answer

A: SSO users are able to use Org API Tokens. Super Users can create Org API with necessary permissions. SSO users do not support “user based” API tokens. Alternatively, local service accounts can be used as well based on customer preference.

Question 17

Q: Do I need a local user within Mist?

Accepted Answer

A: When you start using SSO, you can delete any previously created local user accounts in Mist, except one. It is recommend to keep a local user with the Super User role to ensure that you do not get locked out of the org in the event of an issue with the SSO. Since a person cannot use one email address for both SSO and a local account, the local account should be set up with a different email address than the one they'll use with SSO. For example, use a personal email address for the local account and use the work email address for the SSO account. For more information about steps to set up SSO users, seeAdd Identity Providers and Users

Follow these steps to add identity providers (IdPs) to use to authenticate your portal users.

.

Question 18

Q: Why do I see a certificate mismatch error when setting up SSO?

Accepted Answer

A certificate mismatch error usually occurs when the Identity Provider (IdP) certificate configured in Mist does not match the certificate used by your IdP for signing SAML assertions, causing authentication failures. This error typically occurs due to missing certificate information, expired certificates, incorrect certificates, or multiple certificates in the IdP. To resolve this issue:

Download the correct certificate from your IdP and ensure it includes the full text with headers and footers.
Confirm that the certificate is valid. If the certificate has expired, generate a new certificate in your IdP portal and update the details in the Mist portal.
Confirm whether the IdP has issued a new certificate and update the latest certificate information in the Mist portal.

Additionally, it is important to maintain at least one local administrator account in Mist. This ensures alternative access if SSO fails due to certificate-related issues.

Question 19

Q: Why doesn't a local account convert to an SSO account when authenticating through the IdP?

Accepted Answer

When you set up Single Sign-On (SSO) and a user logs in through the Identity Provider (IdP), Mist automatically converts the user’s account from a local account to an SSO account. However, this conversion does not happen if

The e-mail address in the IdP assertion does not exactly match the e-mail address of the user's account in Mist.
The IdP does not send the correct attribute (such as Name ID or e-mail address) to Mist for user identification.
The same e-mail address is tied to an SSO account in another organization.
The local user has a role that does not map correctly to the SSO role.

本页内容

有关 SSO 的常见问题

问：我应该了解哪些 Mist SSO 实施的基础知识？

问：Mist 支持哪些 IdP 进行 SSO 访问？

问：Mist 是否支持 SP 和 IdP 发起的 SSO？

问：我需要在断言中发送哪些属性？

问：你们支持哪些 NameID 格式？

问：角色有什么用？

问：是否可以为用户返回多个角色？

问：如何排除 SSO 故障？

问：是否需要在 Mist 中手动配置 SSO 用户？

问：我的 SSO 用户的首次登录流程是怎样的？

问：如何知道哪些 SSO 用户访问了我的组织？

问：Mist 是否有元数据文件？

问：我的组织中需要多个 SSO。Mist 支持吗？

问：我有多个组织，我可以将 SSO 用于多个组织吗？

问：删除 Mist 中的 SSO 会怎样？

问：API 令牌如何与 SSO 用户配合使用？

问：Mist 中是否需要本地用户？

问：为什么在设置 SSO 时会看到证书不匹配错误？

问：为什么通过 IdP 进行身份验证时，本地帐户无法转换为 SSO 帐户？