In a multi-tenant Commvault environment, service providers can configure SAML authentication for all tenants by configuring SAML authentication at the CommCell level. When set at the CommCell level, SAML authentication applies to all companies in the Commvault environment.
To configure SAML authentication at the CommCell level, you must map a company name attribute. The value sent in the company name attribute must match the value in the Company alias box on the company details page. If a matching company alias is not found, the user cannot log on. If a value is not sent in the company name attribute, a new user is created at the CommCell level and is not associated with a company.
Note: When you configure SAML authentication at the CommCell level, advise tenants to not configure SAML authentication at the company level.
Before You Begin
Add a SAML application. For instructions, see Adding Identity Servers.
In the identity provider (IdP) response, identify the attribute that is used for the company name. The attribute can be a standard attribute or a custom attribute.
From the navigation pane, go to Manage > Security.
The Security page appears.
Click the Identity servers tile.
The Identity servers page appears.
In the Name column, click the SAML application name.
The SAML application details page appears.
On the General tab, in the Attribute mappings section, click the Edit button .
The Edit attributes dialog box appears.
In the Custom attributes list, click Company name.
In the SAML attributes box, enter the attribute that is used for the company name in the IdP response.
For example, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/organization.
On the Associations tab, identify the users who can log on using SAML:
All users that have an associated email suffix or belong to an associated company, domain or user group, can log on using the SAML application
Tip: You can add any combination of associations, and you can add multiple associations in each category.
For information about mapping additional SAML attributes, see Mapping SAML Attributes.