SAML Authentication

By default, Tamr uses local database-backed authentication and authorization.

If your deployment requires it, Tamr also supports SAML 2.0 for web-based, cross-domain single sign-on (SSO). When configured to use SAML 2.0, users are re-directed to authenticate to the Service Provider, here Tamr, using your Identity Provider .

In addition to configuring SSO with SAML, you may want to specify custom credentials for Postgres. See Postgres.

Configuring SSO Using SAML 2.0

To configure SSO using SAML 2.0:

For each of the following configuration variables, set the configuration variable using the admin tool. See Creating or Updating a Configuration Variable.
Restart Unify and its dependencies. See Restarting.

Required Configuration Variables

TAMR_UNIFY_ENABLE_SAML

Configuration Variable	Example Value
TAMR_UNIFY_ENABLE_SAML	`true`

TAMR_SAML_SSO_LOCATION

Configuration Variable	Example Value
TAMR_SAML_SSO_LOCATION	`https://mycompany.com/IdP`

The URL of the Identity Provider that the user is directed to in order to initiate single sign-on.

TAMR_SAML_ENTITY_ID

Configuration Variable	Example Value
TAMR_SAML_ENTITY_ID	`https://tamr.mycompany.com`

The id used to describe the Service Provider, here specified as Tamr.

This id is used by the Identity Provider to look up relevant metadata and should be globally unique. We recommend setting it to the URL of the Tamr instance.

TAMR_SAML_PRINCIPAL_FIELD

Configuration Variable	Example Value
TAMR_SAML_PRINCIPAL_FIELD	`mycompany.nameid`

The field name in the Identity Provider response that represents the authenticated principal.

TAMR_SAML_AUTH_COMPARISON_TYPE

Configuration Variable	Example Value
TAMR_SAML_AUTH_COMPARISON_TYPE	The default value is `minimum` Possible values are: `exact`, `minimum`, `maximum`, and `better`.

The minimum authentication method strength required. It represents the RequestedAuthenticationContext comparison value in SAML and is based on the signicat.security-level value from the authentication method.

TAMR_SAML_COOKIE_DOMAIN

Configuration Variable	Example Value
TAMR_SAML_COOKIE_DOMAIN	`tamr.mycompany.com`

The domain used for setting the cookie that stores the Tamr authenticated session. This should match the domain of the URL of the Tamr instance.

Optional Security Configuration

TAMR_SAML_IDP_CERTIFICATE_PATH

Configuration Variable	Example Value
TAMR_SAML_IDP_CERTIFICATE_PATH	`/path/to/certificate.crt`

Location of the certificate file on the Tamr local filesystem that is used to validate the response sent back from the Identity Provider. If empty, it is assumed that the Identity Provider server is sending unsigned data.

TAMR_SAML_ATTRIBUTE_DECRYPT_KEY_PATH

Configuration Variable	Example Value
TAMR_SAML_ATTRIBUTE_DECRYPT_KEY_PATH	`/path/to/decrypt/key/file`

Location of the public key file on Tamr local filesystem that decrypts the authentication response from the Identity Provider. The public key should be provided by the Identity Provider. If empty, it is assumed that the Identity Provider is sending unencrypted data.

TAMR_SAML_AUTH_SIGNING_KEY_PATH

Configuration Variable	Example Value
TAMR_SAML_AUTH_SIGNING_KEY_PATH	`/path/to/signing/key/file`

Location of the private key file on the Tamr local filesystem that is used to sign authentication requests to the Identity Provider. The matching public key should be provided to the Identity Provider. If empty, it is assumed that the Service Provider will not sign its authentication requests.

Optional User Information Configuration Variables

Configuration Variable	Example Value
TAMR_SAML_FIRST_NAME_FIELD	`mycompany.firstname`
TAMR_SAML_LAST_NAME_FIELD	`mycompany.lastname`
TAMR_SAML_EMAIL_FIELD	`mycomany.email`
TAMR_SAML_GROUP_MEMBERSHIP_FIELD	`mycompany.groups`

Identity Provider response fields used for updating user information and authorization in Tamr.