Enterprise Vault™ Installing and Configuring

Step 1: Register a new application in Identity Provider with the details about Enterprise Vault Server

1. Sign in to the Identity Provider administrator portal.
2. Register New Application. During the application registration, if asked, provide the following details:

   • Name of the App: Enterprise Vault Search

   • Platform: Web based

   • Sign On Method: SAML 2.0

   • Single sign on URL OR ACS URL: https://<your-EVserver-server-name-here >/EnterpriseVault/Search/SamlAcs.aspx

     Note:

     The URL specifies the location where the SAML assertion is sent by the IdP with a HTTP POST. This is often referred to as the SAML Assertion Consumer Service (ACS) URL of the application.

     Note:

     If you have deployed Enterprise Vault in a cluster environment:

     Single sign on URL OR ACS URL:

     https://<Enterprise Vault Server IP OR Host name>/EnterpriseVault/Search/SamlAcs.aspx

     Here, provide the virtual IP or Role IP host name.

     For example, https://<Virtual IP/host name>/EnterpriseVault/Search/SamlAcs.aspx

   • Audience URI (SP Entity ID) or Issuer: https://<your-EV-server-namehere>/

     Note:

     It specifies the application-defined unique identifier that is the intended audience of the SAML assertion. This is most often the SP Entity ID of the application.

     Note:

     If you have deployed Enterprise Vault in a cluster environment:

     Audience URI (SP Entity ID) or Issuer:

     https://<EV Server IP OR Host name>/EnterpriseVault/Search

     For example, https://<Virtual IP or Role IP host name>/EnterpriseVault/Search/

   • Ensure that the Attribute Statement of assertion is configured to return the User Principal Name (UPN) value of the user (for example, user@WindowsADdomain.com), with attribute name UPN. Enterprise Vault uses this value to map with the Windows Active Directory user for authorization.

     Note:

     Ensure that the Response configuration is such that the SAML Response and the Assertion in the response must be signed using Signature Algorithm RSA-SHA256.

     Enterprise Vault currently does not support automatic configuration for SAML using MetaData URL. All the configuration details need to be configured manually.

3. Once the application is registered, go to the Sign On tab of the registered application, and then click View Setup Instructions. Note down the following values of the registered application:

   • Identity Provider Single Sign-On URL value: The location where the SAML request will be sent to the IdP with a HTTP POST. You need this value to set the SSO Service Location setting in Enterprise Vault Administration Console.

   • Identity Provider Issuer value: The unique identifier of the registered application in IdP, that is the intended source who sends the SAML assertion. This is most often the IdP Entity ID of the application. You need this value to set the Issuer URL in Enterprise Vault Administration Console.

   • Download the certificate of your registered application, and save the certificate (.cert or .cer) file somewhere on your Enterprise Vault server. If multiple formats of the certificate are presented for download by the IdP, then choose the Base64 Certificate format for download. You need this certificate file while configuring SSO on Enterprise Vault Administration Console.

4. Assign permissions to all the required users who should be allowed to access Enterprise Vault Search.

Step 2: Configure the required properties in Enterprise Vault Administration Console

1. In the Administration Console, go to Site > Properties > Single Sign-On page.
2. Configure Single Sign-On for Enterprise Vault Search.

   For more information on how to configure Single Sign-On, see Site Properties: Single Sign-On in the Administration Console help.

Step 3: Run UpdateEVWeb.exe using Enterprise Vault Management shell

1. Open the Enterprise Vault Management Shell.
2. Run UpdateEVWeb.exe /Option.

   Option can be one of the following:

   • EnableSAML: Enable SAML authentication and use the SAML configuration specified in the Enterprise Vault Administration Console.

   • DisableSAML: Disable SAML authentication and revert to Windows Integrated authentication.

     For example, RunUpdateEVWeb.exe /EnableSAML