Configure SAML Options in AIQ

Last reviewed: September 24, 2026

SAML (Securityoptions Assertionconnect MarkupAIQ Language) enables youauthentication to accessan multipleidentity webprovider applicationsfor usingsingle one set of login credentials. This is also known as SSO (Single Sign-On).sign-on.

Appvance

Recommended AIQguidance

supports

• Coordinate changes with the identity-provider owner before updating SAML 2.0metadata.
• Keep protocola SSO.verified Appvanceadministrator behavesfallback aspath anbefore applicationenabling or servicechanging providerSSO.
• Track incertificate aexpiration SAML SSO architecture.

  It has been tested against SAML identity providers, including Okta (>http://okta.com )dates and Auth0renew (>https://auth0.com/them )before users are impacted.

Validation workflow

1. Collect IdP metadata, entity ID, ACS URL, and Akamaicertificate (>https://www.akamai.com/).details.
2. Enter

   Fullor SAMLv2 specs can be found here >http://saml.xml.org/saml-specifications

   Security overview of SAMLv2: >http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html

    Configuring SSO

   When using SSO the standard login still applies. Only the appvance owner user can enable SSO.

1. Login to AIQ as an administrator user.

Navigate to Global Options > Admin Options > SAML Options.

There you can defineupdate the SAML configuration

settings in AIQ.Test login with a limited user group before broad rollout.

Note:

Every field is required. Following are the specs for each field. Configure the following fields:

• Certificate (X.509) - This is the certificate ofChanging SAML usuallycan theyaffect haveuser theaccess. next format

  -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----

• Identity Provider ID - An Identity Provider isConfirm a federationfallback partneradmin thataccount vouchesbefore forsaving the identity of a user. The Identity Provider authenticates the user and provides an authentication token (that is, information that verifies the authenticity of the user)

   

• Service Provider Entity ID URL - This is a service name configured in the SAML IDP. This is very important as SAML is a security environment, Appvance needs to have knowledge of the IDP endpoint but also IDP needs to be aware of SAML existence.

  Appvance uses the Service Provider Entity ID URL (also called audience restrictions) as the consumer URL.

• Metadata URL - Some SAML IDP provides some configuration requirements, usually in a metadata URL. IF the IDP does not provide this field, you can use Single Sign-On URL

• Single Sign-On URL - This is the URL the user will be redirected to if they choose to

Upon setting the values, the welcome pageproduction SSO button will become enabled. By default, it is disabled.changes.

The SSO user's role is always “User”. They will start with the string “sso.” and the username provided by the SAML IDP service.

Configuring your the Identity Provider

You will need to provide the following URL to the Identity Provider that points to your AIQ controller server (app service provider):

https://<aiq controller DNS or IP>:8443/AppvanceServer/saml