SAML SSO¶

The basic workflow for configuring SAML SSO is as follows:

1. Review and complete the prerequisites.
2. Configure SSO in your identity provider and identify DataRobot as the service provider.
3. Configure SSO in DataRobot:
   • Choose a configuration option to set up the Entity ID and IdP metadata.
   • Use mapping to define how attributes, groups, and roles are synchronized between DataRobot and the IdP.
4. Set SSO requirements, including making SSO optional or required for all users.

The Self-Managed AI Platform provides enhanced SAML SSO :

The basic workflow for configuring SAML SSO is as follows:

1. Review and complete the prerequisites.
2. Configure SSO in your identity provider and identify DataRobot as the service provider.
3. Configure SSO in DataRobot:
   • Choose a configuration option to set up the Entity ID and IdP metadata.
   • Use mapping to define how attributes, groups, and roles are synchronized between DataRobot and the IdP.
4. Modify security parameters to increase or decrease the SAML protocol security strength.
5. Set up advanced options.
6. Set SSO requirements, including making SSO optional or required for all users.

• SAML for SSO is enabled.
• The organization has at least one Org/System admin; the admin will be responsible for SAML SSO configuration once it is enabled.

Contact your DataRobot representative to enable SAML SSO, and if necessary, to set up the first Org/System admin user (that user can then assign additional users to the Org/System admin role).

• SAML for SSO is enabled.
• The organization has at least one System admin; the System admin will be responsible for SAML SSO configuration once it is enabled.

Contact your DataRobot representative to enable SAML SSO, and if necessary, to set up the first System admin user (that user can then assign additional users to the System admin role).

Use the root URL with the organization name appended. The organization name is the name assigned to your business by DataRobot, entered in lowercase with no spaces.

Make sure that the following required configuration is complete on the IdP side—this example uses Okta.

1. If you don't already have an Okta developer account, sign up for free using your GitHub username or email.
2. In Okta, click Applications > Applications in the left-hand navigation.

3. Click Create App Integration, select SAML 2.0, and click Next.

   

4. On the General Settings tab, enter a name for the application and click Next.

   

5. On the Configure SAML tab, fill in the following fields:

   • Single sign-on URL
   • Audience URI (SP Entity ID)
   • Attribute Statement for username

   

   Note

   The Single sign-on URL has signed-in at the end. The attribute username must be set to user.email in order for SSO login to be successful with DataRobot.

6. On the Feedback tab, select I’m a software vendor and click Finish.

   

7. With your new application selected, click Applications > Assignments and assign People or Groups to your app.

   

8. On the Sign On tab, locate the SAML Signing Certifiates section. Next to SHA-2, select Actions > View IdP metadata and copy the IdP metadata link address—you will need this to configure SSO in DataRobot.

   

Make sure that the following required configuration is complete on the IdP side—this example uses PingOne.

Configure the PingOne SSO Environment

1. In PingIdentity, navigate to the Your Environments page and click Add Environment.

   

2. Select Customer solution and click Next.

3. Click Next again.

   

4. Name the environemnt (TestDataRobotSSOEnv in this example) and click Finish.

Configure a PingOne SSO Application

1. Select the PingOne Environment you want to use to house your SSO application (TestDataRobotSSOEnv in this example).

   

2. Click the Add a SAML app tile and open the Connections tab.

   

3. Click the + icon the right of the Applications.

   

4. Name the application (TestDataRobotSSOApp in this example), select SAML Application, and click Configure.

5. Select Manually Enter; then copy and paste the following:

   • Copy the IdP initiated login URL from DataRobot and paste it in the ACS URLs field.
   • Copy the Entity ID from DataRobot and paste it in the Entity ID field.

   

6. Click Save.

7. On the Configuration tab, click the pencil icon.

   

8. Make sure Sign Assertation & Response is selected.

   

9. Scroll down to the Subject Named Format dropdown. Click the dropdown and select urn:oasis:names:tc:SAML:2.0:name-id:transient.

   

10. Click Save.

11. Use the toggle to turn on the TestDataRobotSSOApp PingOne application.

    

12. Save the IDP Metadata URL. You will need this to configure SSO in DataRobot.

    

Map Attributes

1. Click the Attribute Mappings tab and click the penicl icon.

   

2. Next to saml_subject, change the PingOne Mapping to Email Address. Click Add, enter username under Attributes, and select Email address for the the PingOne Mapping.

   

3. Click Save.

Make sure that the following required configuration is complete on the IdP side—this example uses Azure Active Directory.

1. Sign into Azure as a cloud application admin.

2. Navigate to Azure Active Directory > Enterprise applications and click + Create your own application.

   

3. Name the application, select Integrate any other application you don't find in the gallery (Non-gallery), and click Add.

   

4. On the Overview page, select Set up single sign on and select SAML as the single sign-on method.

   

5. Click the pencil icon to the right of Basic SAML Configuration. Populate the following fields:

   • For Identifier (Entity ID), enter an arbitrary string.
   • For Reply URL (Assertion Consumer Service URL), enter <domain>/sso/saml/signed-in/.

   

6. Click Save.

7. Click the pencil icon to the right of User Attributes & Claims. Delete all default additional claims and add the following claims:

   • username as Name.
   • Attribute as Source.
   • user.userprincipalname as Source attribute.

   

   Note

   If the form prevents you from saving without a Namespace value, provide any string, click Save, and then edit it again to remove the Namespace value. After saving, the new claim appears in the table.

8. To make sure the test account has access to the application, open Users and groups in the left-hand navigation and click Add user.

   

9. Copy the Identifier (Entity ID) and App Federation Metadata URL—you will need these values to configure SSO in DataRobot.

   

Complete the following fields:

Complete the following fields:

Complete the following fields:

Complete the following fields:

Auto-generate Users automatically adds new users to DataRobot upon initial sign on.

Attribute mapping allows you to map DataRobot attributes (data about the user) to the fields of the SAML response. In other words, because DataRobot and the IdP may use different names, this section allows you to configure the name of the field in the SAML response where DataRobot updates the user's display name, first name, last name, and email.

Groups mapping allows you to create an unlimited number of mappings between IdP groups and existing DataRobot groups. Mappings can only be one-to-one.

To configure, set:

Roles mapping allows you to create an unlimited number of mappings between IdP and DataRobot roles. Mappings can be one-to-one, one-to-many, or many-to-many.

To configure, set:

If you have selected to enforce SSO, the username and password login is hidden and only the SSO login displays:

If SSO is optional, users can choose their login method:

Once SSO is configured, provide users with the SP initiated login URL to sign into DataRobot (found under Manage SSO > Service Provider Details). Managed AI Platform users cannot access SSO via the login screen at app.datarobot.com.

Session & Binding controls how DataRobot and the IdP communicate—SAML requirements vary by IdP.

To configure, set:

Client Config allows users to set private keys and certificates.

To configure, set:

A private key must be set before DataRobot can sign SAML authentication requests.

To set a private key:

{
  "key_file": "/opt/datarobot/DataRobot-7.x.x/etc/certs/key.pem"
}

Where key_file is a path to the key PEM file. The same is valid for a certificate file (use the cert_file field in that case). The following JSON can also be provided to upload secrets as content:

{
  "key_file_value": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----",
  "cert_file_value": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

Where there is an ellipsis in the example, insert the private key (in PEM format) as a single line. The same is valid for certificate file (use cert_file_value field in that case).

Describe key pair to allow DataRobot to decipher IdP SAML responses. This step is required in case IdP cyphers its responses.

{
  "encryption_keypairs" : [{
    "key_file" : "/opt/datarobot/DataRobot-7.x.x/etc/certs/key.pem",
    "cert_file" : "/opt/datarobot/DataRobot-7.x.x/etc/certs/cert.pem"
  }]
}

Note that Okta requires an extra parameter (id_attr_name_crypto) when the key pair is described.

{
  "encryption_keypairs" : [{
    "key_file" : "/opt/datarobot/DataRobot-7.x.x/etc/certs/key.pem",
    "cert_file" : "/opt/datarobot/DataRobot-7.x.x/etc/certs/cert.pem"
  }],
  "id_attr_name_crypto" : "Id"
}

The key pair can also be described by its content rather than its file paths. See the private key example above.