SAML 2.0-based authentication is how QoreStor supports single sign-on (SSO) capabilities through an external identity provider (IdP). QoreStor supports only service provider-initiated login. QoreStor SAML configuration is compatible with the following IdPs:

• Azure AD
• OneLogin
• Okta

Accessing the SAML configuration settings in QoreStor

To access the SAML configuration settings in QoreStor

1. To display the Users configuration page, in the navigation menu, click Users.
2. Click Configure SAML.
3. Provide the URLs displayed on the SAML Configuration page to your chosen IdP:
   • Service Provider EntityId. This URL serves as a unique identifier that represents the particular QoreStor server to the IdP.
   • Service Provider MetaData URL. This URL provides an endpoint on the QoreStor Server that QoreStor uses to furnish keys and additional SAML endpoints to the IdP.
   • Service Provider ACS (Assertion Consumer Services) URL. This URL provides an endpoint on the QoreStor Server that the IdP uses to send its authentication response after the IdP has successfully authenticated a user attempting to login to QoreStor. The IdP uses this URL to redirect the user's browser session back to the QoreStor Server to allow authenticated access to the QoreStor Server.
4. To complete the SAML configuration, obtain the Identity Provider Metadata URL from the IdP and enter it in the text box.

   This URL is required. It contains the URL of the metadata endpoint provided by the IP to furnish keys and additional SAML endpoints to the QoreStor Server.

5. Click Save.
6. Restart the QoreStor UI using the following command:

   /opt/qorestor/bin/storage-server-services/ocaui restart

   NOTE:For SAML redirection to succeed, the QoreStor hostname should be resolvable from the Client browser.

   For more information about configuring SAML for QoreStor, see the QoreStor SAML Configuration Guide.

Registering an SSO user with the QoreStor Server

To register an SSO user with the QoreStor Server

1. To display the Users configuration page, in the navigation menu, click Users.
2. To display the Add User sidebar, click Add User.
3. From the Authentication Type drop-down menu, select SAML as the authentication type for the new user.
4. For User (Email), enter the email address of the user that was configured in the IdP for access to the QoreStor Server.

   The value provided must be of a valid email address format; for example, john.doe@example.com).

5. From the Roles drop-down menu, select either the Administrator role or Monitor role.
6. Optionally, enter the following details:
   • Full Name
   • Phone
   • Description
7. To add the registered user account with the QoreStor Server, click Save.

   The QoreStor UI Login page now includes a SAML Sign In option.

Logging in to the QoreStor UI using SAML

To log in to the QoreStor UI using SAML

1. From the QoreStor UI Login page, click SAML Sign In.

   The browser redirects you to the configured IdP's login page.

2. On the IdP login page, enter the required IdP user credentials.
3. Optionally, if you configured MFA for your account with the IdP, enter the requested second factor token or provide approval through a mobile application.

   After the IdP authenticates the credentials, the browser session redirects to the QoreStor UI. If the authentication was successful, the QoreStor UI login page briefly displays before the browser session redirects to the QoreStor UI Dashboard.

   You are now logged in to the QoreStor Server.