Configuring SAML on Alteryx Server for OneLogin
Alteryx Gallery allows the use of most Identity Providers (IdP) that support the SAML 2.0 standard to be configured as an authentication method.
The following information will assist with configuring Alteryx Gallery to be functional with OneLogin.
Prerequisites
- OneLogin
- Account with access to perform administration tasks
- All users that will login must have an email address attribute
- Alteryx Server >= 2018.2*
- Account with access to perform administration tasks
Procedure
- In the OneLogin Administration screen, highlight Apps in the top navigation menu and select Add Apps.
-
On the Find Applications screen, find and search for the SAML Custom Connector (Advanced) application. Select that application.
-
Fill in the name, description, and details for the Alteryx Gallery. Then, click Save.
- Click Configuration in the navigation menu. Fill out the details based around your root Gallery URL and add the bolded values as seen below.
If you have SSL configured with the Alteryx Gallery, use https:// instead of http://.
With the ACS URL Validator, copy the SAML Consumer URL and escape and metacharacters in the address.
Note: The SAML Audience may be case sensitive depending on settings in your environment. It is recommended to enter the values with the capitalization as shown in the screenshot and example URLs below.
For 22.1 and below:Base URL: http://company-server.alteryx.com/gallery/
SAML Consumer URL: http://company-server.alteryx.com/aas/Saml2/Acs
SAML Audience: http://company-server.alteryx.com/aas/Saml2
SAML Recipient: http://company-server.alteryx.com/aas/Saml2
ACS URL Validator: http:\/\/company-server.alteryx.com\/aas\/Saml2\/Acs
For 22.2 (FIPS) / 22.3+:Base URL: http://company-server.alteryx.com/gallery/
SAML Consumer URL: http://company-server.alteryx.com/webapi/Saml2/Acs
SAML Audience: http://company-server.alteryx.com/webapi/Saml2
SAML Recipient: http://company-server.alteryx.com/webapi/Saml2
ACS URL Validator: http:\/\/company-server.alteryx.com\/webapi\/Saml2\/Acs
***If you are doing an upgrade you can use the old endpoints but if you are new installation/configuration for 2022.3+ Please use 22.3+ endpoints above
When finished, click Save. -
Under the Parameters section we need to map the Claims attributes to match between Alteryx Gallery and OneLogin. Use the below table for the appropriate values between the two. The Alteryx Gallery Attributes are case sensitive.
OneLogin Value
Alteryx Gallery Attribute
Email
email
First Name
firstName
Last Name
lastName
Note: OneLogin provides a starting Field you can modify, Email (NameID), ignore this as the email setting we need, maps to a different value.
- Select Include in SAML assertion and then Save.
-
Repeat steps 7 and 8 for firstName and lastName. When finished, click Save.
- In the SSO section, switch the SAML Signature Algorithm to SHA-256. Then copy and save off the Issuer URL value for the next step. When finished, click Save.
- Open the Alteryx System Settings and click Next until the Server UI/Gallery->Authentication section.
- Set the Select an option for obtaining metadata required by the IDP to IDP Metadata URL.
- Leave the ACS Base URL field as is unless you are configuring your Server UI with a load-balancer or separate DNS name.
- Paste the Issuer URL from the previous step into both the IDP URL and IDP Metadata URL fields.
- Click Verify IDP in the Alteryx System Settings. This will prompt you with the OneLogin login screen. Fill out your OneLogin username and password.
If everything is set up correctly, you will see a success message and your email address filled out in the Default Gallery Administrator setting. You can then click Next and configuring the rest of Alteryx System Settings if needed and Finish at the end to start the service utilizing the newly configured authentication.
Common Issues
-Verify the user account has access to the OneLogin application. You can verify this at Users->(user account)->Applications
AlteryxAuthorizationService.exe has stopped working or there is a failure to set the Default Gallery Administrator
-Turn off IE Enhanced Security Configuration on the Alteryx Server if you have crash errors while verifying the IDP information. This feature can be turned back on once you have the configuration in a functional state.https://www.limestonenetworks.com/support/knowledge-center/17/70/how_do_i_disable_internet_explorer_...
-Verify that the values in theSAML IDP Configurationare correct for your OneLogin application.
-Verify that the OneLogin application was configured with the correct claim attributes.
-Check the AlteryxAuthorizatonService.exe logging directory (%PROGRAMDATA%\Alteryx\Logs) for any clues.
-OpenEvent Viewerwithin Windows and look for errors that may be of use in theApplicationlog.
-If still stuck, reach out to ourSupport team. I'd suggest providing the following:
1. Values set in the Alteryx System Settings application for SAML
2. AAS log files (found in %PROGRAMDATA%\Alteryx\Logs\)
3. Configuration screenshots for OneLogin