topic Re: SAML Integration with AD Self Service Plus in Network Platform API

SAML Integration with AD Self Service Plus

AnthonyJulien — Thu, 26 Dec 2024 10:56:55 GMT

Hi everyone!

I hope everything is fine.

I'm trying to integrate Cisco Meraki with AD Self Service, so the users can login to Meraki directly from the AD Self Service.

I have run the tests, but I am getting the error: Assertion contains no username and no role.

I'm relatively new to this SAML thing, and don't know how to resolve it.

Any help would be greatly appreciated.

I can see the username in the XML file, but no role? How should I be adding all of these things?

Re: SAML Integration with AD Self Service Plus

RWelch-USA — Thu, 26 Dec 2024 11:31:39 GMT

Configuring SAML Single Sign-on for Dashboard

Re: SAML Integration with AD Self Service Plus

RWelch-USA — Thu, 26 Dec 2024 11:32:56 GMT

Integrating Active Directory with Sign-On Splash Page For MR Access Points

Re: SAML Integration with AD Self Service Plus

sungod — Thu, 26 Dec 2024 11:33:45 GMT

Have you defined the role(s) you want in Dashboard?

Org->Aministrators, scroll down to SAML administrator roles, if not you need to add at least one role.

The role defines what access rights a matchng user will be given.

Then in your AD, any user that you want to be able to login needs that role in their settings.

I've not used ADSSP but I see there''s a guide for Dashboard...

https://www.manageengine.com/products/self-service-password/help/admin-guide/Application/sso/merakicisco.html

...it says....

Please make sure in Cisco Meraki the role (Organization > Administrators) maps to the department attribute and the username maps to the mail attribute in Active Directory.

There are also several SAML guides in Meraki documentation, for instance...

https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_SSO_with_Microsoft_Entra_ID

With Dashboard SAML a user must have one role.

Re: SAML Integration with AD Self Service Plus

AnthonyJulien — Thu, 26 Dec 2024 13:36:59 GMT

Hello!

Thank you so much for the help!

I did the steps exactly as you mentioned from the AD side, and the issue was resolved (although I got another error, it seems I cannot use the same email address for both regular signin and SAML signin).

So I created another user with an email address not in use yet in Meraki, and I was able to login as expected without any issues.

That was a quick reply as well, thank you!

Re: SAML Integration with AD Self Service Plus

Philip D'Ath — Thu, 26 Dec 2024 19:58:56 GMT

ps. You can have your SAML provide pass anything for the username, such as sAMAccountName or displayName. If you don't pass an email address you avoid this issue of existing accounts.