Questions on SAML/SSO configuration on Edge Private Cloud 4.17.09

[#1]

Hi Team,

A customer plans to use SAML/SSO feature on Edge Private Cloud 4.17.09 release. And they have questions as follows;

1. How to enable/disable Edge SSO and to use different SAML IDP for each org?

By looking at the config file used for apigee-sso and edge-ui setup it seems that all the orgs have single config file by the default setup.

Then how can we configure different SAML IDP by 'SSO_SAML_IDP_NAME=' and enable/disable UI with 'EDGEUI_SSO_ENABLED=y/n' for each org independently?

2. Is it possible to configure TLS encrypted communication between Edge UI and Edge SSO?

By looking at the Apigee Docs it seems TLS config between Edge SSO and SAML IDP only are explained.
Is it also possible to enable it for Apigee system internal communication?

Could you please answer to these questions?
I'll appreciate your help.

Regards,
Toshi

[sgilson · Accepted solution]

HI @Toshihiro Shibamoto\

I can respond to a few of these.

For #1, there is no way that I know of to enable SAML at the org level or use a different IDP for each org. Edge SSO config has a single, global setting for the IDP and the UI has a single, global setting to enable to disable SAML.

For #2, TLS is possible. See the doc here. That doc describes two ways to enable TLS on Edge SSO, which then means the UI uses TLS to access it.

Stephen

[#3]

@sgilson Thank you very much for the answer and the clarification!