OVERVIEW

GDMS and GWN Manager support SAML (Security Assertion Markup Language) to provide external authentication and Single Sign-On (SSO) using third-party identity providers such as Microsoft Entra ID (Azure AD), AD FS, and Duo.

This guide outlines how to configure SAML information on supported third-party identity providers as well as how to use SAML SSO on GDMS (Cloud) and GWN Manager (On-Prem).

SAML COMPONENTS

When using SAML, there are two key elements:

• Identity Provider (IdP): The authority for the user’s identity. It validates user credentials and provides identity attributes by knowing the user’s username, password, and any groups/attributes (Example: Microsoft Entra ID, AD FS, Duo).
• Service Provider (SP): The application that the user wishes to use. In this case, the GDMS platform and GWN Manager.

SAML SSO LOGIN METHODS

SAML SSO login supports two methods:

SAML SSO WITH MICROSOFT ENTRA ID

Firstly, users need to sign up for an Azure account by visiting this web page:

https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-permissions-management

This section mainly introduces how to configure Microsoft Entra ID (formerly known as Azure AD) as the identity provider (IdP) for GDMS.

Step 1: Add a new application in Azure

1. Sign in to the Microsoft Entra admin center as a Cloud Application Administrator or higher.
2. Go to Identity → Applications → Enterprise applications → New application.

3. In the Browse Microsoft Entra Gallery section, click Create your own application.

4. Enter your application name, such as “GDMS”, and select “Integrate any other application you don’t find in the gallery (Non-gallery)“.

5. Click Create to successfully create the application. You can view the application in the list.

Step 2: Create an application role in Azure

1. Sign in to the Microsoft Entra admin center, go to Identity → Applications → APP registrations, and click on the app you have created.

2. Click APP roles on the left, and then click Create app role. Then fill in the display name, select “Both” for type, and the Value must be consistent with the SAML role value expected by the Service Provider, such as “Admin.A“.

3. After successful creation, you can see this role in the list.

Step 3: Add users to the application in Azure

1. Sign in to the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications, find and select the app you created in the application list.
2. Then, click Users and groups on the left bar and select Add user/group.

3. Select the users you want to assign to use this app.

4. Select Assigned Roles and choose from the application roles you just created.

5. Then click Assign. After the assignment is successful, you can see the selected users and the assigned roles in the list. (These users can then log in to GDMS/GWN Manager with a single sign-on)

Step 4: Set up SSO in Azure

1. Sign in to the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications, find and click the app you have previously created.
2. Click Single Sign-on on the left and click SAML on the page.

3. First, within the Basic SAML Configuration section, click Edit.

4. Copy the information from the GDMS/GWN platform and fill in the following information:

5. Then, within the Attributes & Claims section, click Edit.

6. Click Add new Claim.

7. Add the following SAML claims in Microsoft Entra ID. The claim names (URIs) must match the requirements of the target platform.

8. Download the metadata file for configuration on GDMS.

Step 5: SAML SSO in GDMS/GWN Manager

1. Download the metadata of the GDMS application you created from Azure.

2. Log in to the GDMS or GWN Manager platform as a super administrator and navigate to Users→SAML SSO.

3. To configure the identity provider, click “Add SAML IdP” and fill in the information:

4. After adding the IdP, configure the SAML SSO role as described in section [SAML SSO ROLES IN GDMS/GWN MANAGER]. The Role Name must exactly match the role value sent by the IdP.

SAML SSO WITH ADFS

This section describes how to configure AD FS as the Identity Provider for GDMS Cloud and GWN Manager. For more configuration instructions on ADFS, refer to Microsoft’s deployment guide.

Step 1: Add Relying Party Trust in ADFS

1. Open the AD FS management console via Server Manager→Tools→AD FS Management.

2. Click on the top-level folder (AD FS) and click Add Relying Party Trust from the Actions menu.

3. Click Start to launch the wizard.

4. Choose to Enter data about the relying party manually. Then click Next.

5. Enter a Display name, such as “GDMS” or “GWN Manager”, which will be displayed in the management console and to users connecting to GDMS. Then click Next.

6. Click Next to skip the step of Configure Certificate.
7. Enable Support for the SAML 2.0 WebSSO protocol.

8. Enter the Relying Party SAML 2.0 SSO service URL (ACS URL), which can be copied from:
   
   • GDMS: Users→SAML SSO
   • GWN Manager: Organization→Users→SAML SSO

9. For the Relying party trust identifier, fill in the Entity ID displayed on the corresponding SAML SSO (as shown in the figure, click one-click copy). Then click Add and Next.

10. Select the default issuance authorization rule based on your preferred security behavior. For this example, select Permit everyone. Then click Next.

11. Review your settings and complete the wizard.

12. Ensure Configure claim issuance policy for this application is checked.

Step 2: Set NameID Attribute in ADFS

1. Select the Relying Party Trusts you created and click “Edit Claim Issuance Policy” on the right.

2. In the Edit Claim Rules dialog, click Add Rule.

3. For the Claim rule template, choose to Transform an Incoming Claim. Then click Next.

4. Fill in the Claim rule name, Incoming claim type, Outgoing name ID Format, and select Pass Through all claim values as shown in the following screenshot. Then click Finish.

Step 3: Set Email Address Attribute in ADFS

1. Select the Relying Party Trusts you created and click “Edit Claim Issuance Policy” on the right.

2. In the Edit Claim Rules dialog, click Add Rule.

3. For the Claim rule template, choose to Send LDAP Attributes as Claims. Then click Next.

4. Fill in the following information and click Finish.

Step 4: Set Role Attribute in ADFS

1. In the Edit Claim Rules dialog, click Add Rule.

2. For the Claim rule template, choose to Send Group Membership as a Claim.

3. Fill in the following information and click Finish.

Step 5: Configure Single Logout (Optional)

This step describes how to configure SAML Single Logout for GDMS Cloud and GWN Manager when using AD FS as the Identity Provider.

If SAML Single Logout is not configured correctly, users will encounter errors when selecting “Logout from both application and SSO system”.

The following AD FS configuration is required for both GDMS and GWN Manager:

1. Open AD FS Management.
2. Navigate to Relying Party Trusts and right-click the relevant Relying Party Trust (GDMS or GWN Manager) and select Properties.

3. Open the Endpoints tab and click Add SAML.

4. Configure the endpoint as follows:

Step 6: Configure Token-Signing Certificate

1. In the management console, go to AD FS→Service→Certificates. Select a valid certificate under Token-signing.

2. Double-click on the certificate under Token-signing. Under Details→Thumbprint, copy this string and paste it into the X.509 cert SHA1 fingerprint field in GDMS/GWN Manager.

Step 7: SAML SSO in GDMS/GWN Manager

1. The super administrator logs in to the GDMS platform and goes to Users→SAML SSO.
2. Click Add SAML IdP and fill in the information:

3. After adding the IdP, configure the SAML SSO role as described in section [SAML SSO ROLES IN GDMS/GWN MANAGER]. The Role Name must exactly match the role value sent by the IdP.

SAML SSO WITH DUO

Users will have to set up a DUO account first by using this link: https://signup.duo.com/

This section describes how to configure DUO SSO as a SAML Identity Provider for GDMS or GWN Manager.

Duo Single Sign-On is a cloud-hosted SAML 2.0 Identity Provider (IdP) and OpenID Connect Provider (OP) that enables centralized authentication with multi-factor authentication (MFA) and access policy enforcement. Duo can integrate with upstream identity providers such as Microsoft Entra ID, allowing organizations to combine enterprise identity management with Duo MFA.

For details, please refer to the DUO manual: https://duo.com/docs/sso

The screenshots in this section use GWN Manager as the Service Provider (SP). The configuration steps for GDMS are identical except for the SAML attribute URLs used in the Duo application configuration.

Step 1: Create a DUO Authentication Source

1. Log in to the Duo Admin Panel and navigate to Applications→SSO Settings.
2. Click Add source in the External Authentication Sources tab.

3. Click Add SAML Identity Provider.

4. This page contains the values that will be used when configuring the upstream identity provider (for example, Microsoft Entra ID).

Step 2: Configure the Azure Application

In this deployment model, Entra ID authenticates the user and sends the identity assertion to Duo, which then acts as the IdP for GDMS/GWN Manager.

Please refer to the first section of the guide for more information on configuring an App on Entra ID.

1. Add a new application in Azure.
2. Add users to the application in Azure.

3. Go to Identity→Applications→Enterprise applications, find and click the DUO application you created in the application list.
4. Click Single Sign-on on the left and click SAML on the page.

5. Within the Basic SAML Configuration section, click Edit, and configure the following values using the information obtained from Duo.

6. Within the Attributes & Claims section, click Edit, then click Add new claim. Configure the claim as follows:

7. From the SAML Signing Certificate section, download the Federation Metadata XML or copy the following values:
   
   • Login URL
   • Microsoft Entra Identifier
   • Logout URL
   • Certificate (Base64)

Step 3: Configure Single Sign-On in DUO

1. Log in to the Duo Admin Panel and navigate to Single Sign-On.

2. Select the resource you created in Step 1 (SAML Identity Provider).
3. Enter the information copied from Entra ID:

4. Click Save, and verify that the status of the external source appears as “Enabled“.

Step 4: Create Users and Groups in DUO

This section describes how to create Duo users and groups for this integration.

1. Log in to the Duo Admin Panel
2. Navigate to Users→Add User

3. Fill in the following fields:

4. After creating the user, complete enrollment using any supported method:
   
   • Email enrollment
   • Enrollment code
   • Device enrollment

5. Navigate to groups Users→Groups and click “Add Group”.

6. Choose a name for the user group and add an optional description.

7. Click on “Add users to group” to configure users allowed to access GDMS/GWN Manager.

Step 5: Create the DUO SAML Application

1. Log in to the Duo Admin Panel and navigate to Application→Application Catalog.
2. Search for Generic SAML Service Provider.

3. Configure the application name (example: GWN Manager or GDMS).
4. Enable access for all users or select a specific group to grant application access.

5. Configure the Entity ID and ACS URL by copying them from GDMS/GWN Manager, as shown below:

6. Scroll down to continue the configuration. The following three parameters are mandatory and must be configured.

7. To enable IdP-initiated login from the Duo dashboard, configure the Default Relay State to point to the GDMS or GWN Manager login page.

Step 6: SAML SSO in GDMS/GWN Manager

1. Log in to the Duo Admin Panel and navigate to the GDMS/GWN Manager Application.

2. Access the application you created, and copy the following information or download the metadata.

3. Log in to GDMS or GWN Manager using a Super Administrator account.
4. Navigate to Users→SAML SSO.

5. Click Add SAML IdP and fill in the information:

6. After adding the IdP, configure the SAML SSO role as described in section [SAML SSO ROLES IN GDMS/GWN MANAGER]. The Role Name must exactly match the role value sent by the IdP.

SAML SSO ROLES IN GDMS/GWN MANAGER

GDMS Role Configuration

1. Log in as Super administrator logs in to GDMS and goes to Users→SAML SSO→SAML SSO Role.

2. Click Add Role and fill in the following information:

3. Click Next to configure the permissions for the GDMS UC system. If this role does not have permissions for the GDMS UC system, you do not need to select any permissions.

4. Click Next to configure the permissions for the GDMS Networking system.

• If you select Platform Administrator, you must select Manage All Networking in the previous step, otherwise you cannot select Platform Administrator.
• If this role has permissions for the GDMS Networking system, you can select “None”.

5. Click Finish to successfully create the SSO role.

GWN Manager Role Configuration

1. Log in to GWN Manager using a local administrator account.
2. Navigate to Organization→Users→SAML SSO.
3. Select the SAML SSO Role tab.

4. Click Add to create a new SAML SSO role.

5. Enter the name of the SAML SSO role. This value must exactly match the role value sent by the IdP in the SAML assertion.

6. After defining the Role Name, configure the permissions associated with this role. Each option corresponds to a predefined permission scope within GWN Manager.
7. If Custom is selected, granular permissions can be assigned manually.

8. Click Save to complete role creation. The newly created role will appear in the SAML SSO Role list.

SAML SSO TESTING AND VALIDATION

This section describes how to validate SAML SSO authentication and logout behavior when GDMS or GWN Manager is integrated with an Identity Provider.

Testing should verify both authentication flows:

• SP-initiated login: authentication starts from the GDMS or GWN Manager.
• IdP-initiated login: authentication starts from the Identity Provider portal (Entra ID, Duo).

SP-Initiated Login Test

Web Login Test

This test verifies authentication initiated from GDMS or GWN Manager.

1. Open a web browser.
2. Navigate to:
   
   • GDMS: https://www.gdms.cloud
   • GWN Manager: https://<gwn-manager>:<port>
3. Click Sign in with SSO at the bottom of the GDMS/GWN Manager login page.

4. Enter the SSO Access Code configured by the administrator.

5. The SSO Access Code from the GDMS/GWN Manager can be configured on the SAML SSO page as follows:

6. The browser must redirect to the configured IdP login page:
   • Microsoft Entra ID login page
   • AD FS login page
   • Duo authentication page

6. After successful authentication, verify that:
   
   • You are redirected back to the application
   • Login completes successfully
   • The correct SAML SSO role is applied

7. (Optional) If SAML Single Logout (SLO) is configured, click Logout from both the application and the SSO system.

8. Verify that:
   • The GDMS/GWN Manager session is terminated
   • The SSO system is terminated

Mobile App Login Test

1. Click Sign in with SSO at the bottom of the GDMS login page, and then enter the SSO Access Code configured by the administrator.

2. Go to the configured IdP service provider authentication page, such as Microsoft Azure, ADFS, and DUO.

3. After authentication, log in to the GDMS APP with the corresponding SAML SSO role.

IdP-Initiated Login Test

This test verifies authentication initiated directly from the Identity Provider portal.

In IdP-initiated authentication, the IdP generates the SAML assertion and redirects the user to the Service Provider without first accessing the GDMS or GWN Manager login page.

Microsoft Entra ID

SAML SSO can be validated from Microsoft Entra ID using either:

• The Application Test option
• The Microsoft MyApps portal

Access using the Application Test Option

1. Log in to the Microsoft Entra Admin Center.
2. Navigate to Enterprise applications and select the configured GDMS/GWN application.
3. Go to Single Sign-on→SAML.
4. Click Test this application.

If the configuration is correct, the authentication completes successfully, and the browser redirects to GDMS or GWN Manager

Access from Microsoft MyApps Portal

1. Open Microsoft MyApps.
2. Sign in using an Entra ID account with permission to access the GDMS/GWN application.
3. Click the configured GDMS/GWN application tile.
4. Authenticate if prompted, and verify successful redirection and correct role assignment.

AD FS

Before testing, verify that the IdP-initiated sign-on page is enabled on the AD FS server. Open PowerShell as Administrator and run:

Get-AdfsProperties | Select-Object EnableIdpInitiatedSignonPage

If the output shows “False”, enable it:

Set-AdfsProperties -EnableIdpInitiatedSignonPage $true

Run the check command again to confirm the value now shows “True”.

Access via AD FS IdP Sign-On Page

1. Open a browser and navigate to:

https://<adfs-server>/adfs/ls/idpinitiatedsignon.aspx

2. From the application dropdown, select the configured application (GDMS or GWN Manager).

3. Sign in using a domain user account that is a member of the AD group mapped to the GDMS or GWN Manager SAML SSO role.

4. After successful authentication, verify that:
   
   • The browser redirects to GDMS or GWN Manager automatically
   • Login completes without prompting for the SSO Access Code
   • The correct SAML SSO role is applied to the session

DUO

When Duo is configured as the SAML Identity Provider, IdP-initiated login can be performed using Duo Central or through the upstream identity provider (for example, Microsoft Entra ID).

Unlike Microsoft Entra ID, Duo does not automatically create a user application tile for SAML applications. Administrators must manually add the application to Duo Central.

Access via Duo Central

1. Log in to the Duo Admin Panel.
2. Navigate to Applications→Duo Central.
3. Ensure the Status is set to Online. If Duo Central is Offline, tiles will not be available.

4. Click Add tile.
5. Select Add application tile.

6. Locate the configured SAML application (for example, GDMS or GWN Manager).
7. Select the checkbox next to the application.
8. Click Add Tile.

9. The application will now appear in the Duo Central Tiles list. Confirm the application tile shows Enabled only for permitted groups, or Available to all users.

Once the tile has been successfully configured, users can follow these steps to log in from DUO Central:

1. Open a browser and navigate to the Duo Central portal:

https://<your-subdomain>.sso.duosecurity.com

2. Sign in using a user account with access to the configured SAML application.
3. After login, the application tile will be displayed.

4. Click the application tile to initiate IdP-initiated SAML authentication.
5. Enter valid credentials and complete Duo MFA verification if required.

6. After successful authentication, you will be redirected to the configured GDMS or GWN Manager and logged in automatically.

Access via Upstream IdP (Entra ID)

When Duo uses Microsoft Entra ID as the upstream identity provider, users may also initiate login from Microsoft MyApps.

For IdP-initiated login to work correctly in this scenario, the Sign-on URL must be configured in the Entra ID application.

1. Log in to the Duo Admin Panel.
2. Open the configured SAML application and copy the Single Sign-On URL from the application metadata.

3. Log in to the Microsoft Entra Admin Center.
4. Navigate to the Duo application created earlier.
5. Under Basic SAML Configuration, paste the copied URL into the Sign-on URL field.

6. Open Microsoft MyApps, and sign in using the Microsoft Entra ID account configured in Duo.
7. Click the Duo application tile.

8. The browser redirects to the Duo authentication page. Enter the correct credentials and complete Duo MFA verification.

If the configuration is correct, the browser redirects to GDMS or GWN Manager, and the user is automatically logged in with the appropriate role.

SAML SSO LOGS

Administrators can review authentication activity for SAML SSO users using system logs, which can be reviewed in the following systems:

• GDMS
• GWN Manager
• Microsoft Entra ID
• AD FS
• Duo

Reviewing logs from both the Service Provider and Identity Provider can help identify configuration or authentication issues.

Viewing Logs in GDMS

GDMS records SAML login and logout events in the System Log.

1. Log in to GDMS using an administrator account.
2. Access the Account Center logs using one of the following paths, depending on the module in use:
   
   • UC Module: Navigate to System→System Log→Account Center.
   • Networking Module: Navigate to Organization→Change Log→Account Center.

Viewing Logs in GWN Manager

GWN Manager also records SAML authentication events in its system log.

1. Log in to GWN Manager using an administrator account.
2. Navigate to Organization→Change Log→Account Center.

Viewing Logs in Microsoft Entra ID

Microsoft Entra ID records SAML authentication activity in the Sign-in Logs.

1. Log in to the Microsoft Entra Admin Center.
2. Under Enterprise Applications, select the service provider app.
3. Navigate to Identity→Monitoring→Sign-in logs.

Viewing Logs in AD FS

When AD FS is used as the Identity Provider, SAML authentication events are recorded in the Windows Event Viewer.

1. Log in to the AD FS server, open Event Viewer by running eventvwr.msc or searching for “Event Viewer” in the Start menu.
2. In the left pane, navigate to Applications and Services Logs→AD FS→Admin.
3. Review the events listed.

Viewing Logs in Duo

Duo records authentication activity in the Authentication Log, which includes SAML authentication events.

1. Log in to the Duo Admin Panel.
2. Navigate to Reports→Authentication Log.
3. Use the search filters to locate events related to the configured SAML application.