Identity Provider

SOTI MobiControl can be integrated with Identity Providers (IdPs) such as Okta, OneLogin or any other IdP which supports the SAML 2.0 specification.

Important:

SOTI MobiControl requires that the response to the assertion be signed in addition to the assertion itself. Furthermore, SOTI MobiControl cannot accept an encrypted assertion.
SOTI MobiControl currently only supports the SP-Initiated SSO: Redirect/POST flow for the Web Browser SSO profile. Refer to SAML 2.0 specification (5.1.2) for more details.

You can download both the SOTI MobiControl metadata file and the SOTI MobiControl IdP certificate to your computer.

Use the Identity Provider dialog box to:

Add IdP connections - see Adding an IdP connection
Edit existing IdP connections - see Editing an IdP Connection
Delete IdP connections - see Deleting an IdP Connection

Identity Providers


Identity Provider Downloads	This section contains two links: MobiControl Metadata File - click to download the SOTI MobiControl metadata file to your computer. MobiControl IdP Certificate - click to download the SOTI MobiControl IdP certificate file to your computer.
Identity Providers	This section lists the existing IdPs. The list contains the following columns: Name - the IdP name. Click to open the IdP Settings pane of the dialog box, where you can edit the selected IdP's data. IdP URL - the URL from which the IdP's metadata can be uploaded to SOTI MobiControl. Group From - the source of the grouping. Delete - click this icon to delete the IdP.
Add (+)	Click this icon to open the IdP Settings pane of the dialog box, where you can configure the new IdP.
OK	Click this button to close the dialog box.

IdP Settings

This pane of the dialog box opens when you request to either edit an existing IdP configuration or create a new one.


Name	Enter a name for this IdP connection in SOTI MobiControl.
IdP Metadata File	Browse for, or drag and drop into the file, your IdP's metadata file. This file contains information necessary to create a link between your IdP and SOTI MobiControl. You can fill in the rest of the settings manually if you do not have an IdP metadata file or an IdP metadata URL.
IdP Metadata URL	Enter a URL from which your IdP's metadata can be uploaded to SOTI MobiControl, then click Refresh. You can fill in the rest of the settings manually if you do not have an IdP metadata URL or an IdP metadata file.
IdP Entity ID	Enter the globally unique identifier for the SAML IdP. The IdP Entity ID should be obtained from your IdP administrator.
IdP URL	Enter the IdP SSO login URL. SOTI MobiControl uses this URL to initiate the SSO login sequence. The IdP URL should be obtained from your IdP administrator. Note: SOTI MobiControl supports only HTTP-POST binding.
Logout URL	[Optional] Enter a URL that users are redirected to when they log out of the SOTI MobiControl console and Self Service Portal. If a Logout URL is not provided, users are redirected to a default logoff page. Note: SOTI MobiControl does not support single logout (SLO).
Certificates	This section lists the certificates used to authenticate with your IdP. Click the Download icon to open the Add Certificate dialog box, in which you can add a certificate to the list. Click the Delete icon to delete the selected certificate from the list. The certificates in the list are evaluated in order starting from the top until a valid certificate is successful in authenticating with the IdP. Certificates must be in either DER-encoded binary X509 or Base64-encoded X.509 format.

Group Settings

Select one of either Directory or IdP. The available settings will change depending on your selection.

Tip: Remember to create IdP User Groups in the SOTI MobiControl Users view and set their permissions.

If you selected Directory, use this table.


Directory Name	Select a directory from the drop-down list. If you do not have any directories configured, see Managing Directory Service Connections for information on setting one up.

If you selected IdP, use this table.


Group Attributes	Click the chevron to expand this section. The expanded section contains the following controls: List Attribute - enter an assertion attribute for the incoming SAML authentication response that contains groups. List Delimiter - enter a delimiter that splits up attribute values into multiple values. If a delimiter is not set, it is assumed that the attribute value contains multiple XML nodes, each one a different group name. SOTI MobiControl uses these Group Attributes to authorize users. Make sure that you have created these attribute values in your IdP and assigned them to users. You also need to provide the values in the Attribute Statement section of the assertion response so they can be matched against the defined IdP User groups to determine access rights for the user.
User Attributes	Click the chevron to expand this section. The section Map attributes within the IdP SAML response to specific SOTI MobiControl labels. For example, if you associate the `name` attribute in an IdP SAML response with First Name user attribute in SOTI MobiControl, the value of the name attribute that was in the IdP SAML response will appear as the value of the First Name field in the User Details card in the device's Device Information panel of SOTI MobiControl. You can configure the following user attributes: First Name Middle Name Last Name User Principal Name Phone Number Custom Attribute 1 Custom Attribute 2 Custom Attribute 3 Only configured attributes will appear in User Details.

You must Save or Cancel changes.