Download the SSO settings for your iManage environment

Before you begin, download your iManage environment settings in XML format. These settings are used to configure PingFederate using information about your iManage environment.

  1. In iManage Control Center, browse to Network & Security >  Single Sign-On (SSO).
  2. Select Download XML in the Service Provider Settings section. Save the file for use in Configure SSO in PingFederate.

Figure: Download XML option in iManage Control Center

Configure SSO in PingFederate

Complete the following steps in PingFederate to configure single sign-on for iManage users:

  1. Sign in to the PingFederate administrator console.
  2. Browse to SP Configuration.

  3. To create a new SP Connection, select Create Connection.

    NOTE:

    When migrating from the Identity Provider (Legacy) SAML SSO to the Service Provider (Recommended) SAML SSO configuration in iManage Control Center, we recommend that you create a new SP connection in PingFederate. Creating a new SP connection in PingFederate allows you to preserve your existing SSO connection and roll back to it if necessary.

  4. In the Connection Template tab, select Do not use a template for this connection, and then select Next.
  5. In the Connection Type tab, select Browser SSO Profiles, specify SAML 2.0, and then select Next.
  6. In the Connection Options tab, select Next.
  7. In the Import Metadata tab, select File.
    1. Select Choose File.
    2. Select the XML file you downloaded from iManage Control Center in Download the SSO settings for your iManage environment.
    3. Select Open, and then select Next.
  8. In the Metadata Summary tab, the information from the XML file is displayed. Confirm the information, and then select Next.
  9. In the General Info tab, confirm the information displayed, and then select Next.
  10. In the Browser SSO tab, select Configure Browser SSO.
    1. For both Single Sign-on Profiles and Single Logout Profiles, select SP-initiated SSO, and then select Next.
    2. In the Assertion Lifetime tab, and then select Next.
    3. In the Assertion Creation tab, and then select Configure Assertion Creation.
      1. In the Identity Mapping tab, select Standard, and then select Next.
      2. In the Attribute Contract tab, under Extend the Contract, select or enter the following:
          Attribute Contract: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Attribute Name Format: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
        Figure: SP Connections | SP Connection | Browser SSO | Assertion Creation
      3. Select Add.
      4. Select Next.
      5. In the Authentication Source Mapping tab, select Map New Adapter Instance.
        1. In the Adapter Instance tab, select the adapter that you have previously configured in PingFederate. To create a new adapter, select Manage Adapter Instances. For instructions about configuring an adapter, see the PingFederate documentation.
        2. Select Next.
        3. In the Mapping Method tab, select Use only the adapter contract values in the SAML assertion, and then select Next.
        4. In the Attribute Contract Fulfillment tab, set the following values:
            Source: Adapter
            Value: username
          Figure: SP Connection | SP Connection | Browser SSO | Assertion Creation | IdP Adapter Mapping
        5. Select Next.
        6. In the Issuance Criteria tab, select Next.
        7. Select Done to return to the Assertion Creation section.
      6. Select Next to view the Assertion Creation Summary tab.
      7. Select Done to return to the Browser SSO section.
    4. Select Next to view the Browser SSO > Protocol Settings tab.
    5. Select Configure Protocol Settings.
      1. In the Assertion Consumer Service URL tab, select Next.
      2. In the SLO Service URLs tab, select Next.
      3. In the Allowable SAML Bindings tab, deselect ARTIFACT and SOAP. Only select POST and REDIRECT.
      4. Select Next.
      5. In the Signature Policy tab, select Sign response as required. All three options on this page should be selected.
      6. Select Next.
      7. In the Encryption Policy tab, select Next.
      8. In the Summary tab, select Done.
    6. In the Browser SSO > Summary tab, select Done.
  11. Select Next.
  12. In the Credentials tab, select Configure Credentials.
    1. In the Digital Signature Settings tab, set Signing Certificate to the certificate available.
    2. Select Include the certificate in the signature <keyinfo> element.
    3. Select Include the raw key in the signature <keyinfo> element.
    4. Set Signing algorithm to RSA SHA256 (or whatever algorithm your certificate uses).
    5. If necessary, select Manage Certificates to add a manage your certificates.
    6. Select Done.
  13. In the Credentials tab, select Configure Credentials.
    1. In the Digital Signature Settings tab, select Next.
    2. In the Signature Verification Settings tab, select Manage Signature Verification Settings.
      1. In the Trust Model tab, select Next.
      2. In the Signature Verification Certificate, confirm that the certificate is added. This certificate is used to decode messages from iManage.
      3. Select Done.
    3. In the Credentials > Summary tab, select Next.
  14. In the Activation & Summary tab, select Save.
  15. To export the federated metadata XML file for the SP Connection, select Export Metadata, as shown:
    Figure: Select Action > Export metadata
  16. Select Next. You don't need to sign the metadata file.
  17. In the Export & Summary tab, select Export. The metadata file is downloaded to your browser.
  18. Select Done.
  19. Import the Federated Metadata XML file into iManage Control Center by returning to iManage Control Center and completing the steps in Enable SAML SSO.