Set SAML attributes for SSO in CrashPlan

You can integrate any SAML 2.0-compliant identity provider with CrashPlan. By default, you map an identity provider's username and email attributes to CrashPlan. For added security and flexibility, you can use SAML attributes in the Authentication tab of Identity Management to set the SAML 2.0 context and class references in your identity provider's SSO requests, as well as the digest and signature algorithms to use. 

For valid values to enter, see Valid values for SAML attributes below.

Default SAML settings

When you create a new authentication provider in CrashPlan, the default SAML request configuration settings are:

• Authentication context class reference: urn:oasis:names:tc:SAML:2.0:ac:classes:Password
• Authentication context comparison: EXACT
• Authentication digest method: http://www.w3.org/2001/04/xmlenc#sha256
• Authentication signature method: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 

For information on these settings, see Valid values for SAML attributes. 

Edit SAML attributes

1. Sign in to the CrashPlan console.
2. Navigate to Administration > Integrations > Identity Management.
3. Select an authentication provider in the Authentication tab.
4. Click the Edit icon  to the right of SAML attributes.
   The Edit SAML attributes drawer appears.
5. Enter values as described in the Valid values for SAML attributes section below, or as used by your identity provider. 
   

Valid values for SAML attributes

Use the following fields in the Edit SAML attributes drawer to update SAML settings used by the CrashPlan authentication provider:

• Authentication context class reference
• Authentication context comparison
• Authentication digest method
• Authentication signature method

Authentication context class reference

This field maps to the authnContextClassRef attribute. It sets the context class reference to authenticate users. If this parameter is omitted, the AuthN Request will have no Context tag.

You can use any of the SAML 2.0 authentication context classes to authenticate users. The values listed in the table below are the most commonly used in the SAML 2.0 specification. (Because some identity providers have created their own authentication classes which aren't listed in the SAML 2.0 specification, such as for multi-factor authentication, you can still specify any valid authentication class reference as long as it has a correctly formatted URN.)

The value supplied should have one of the following prefixes:

• urn:oasis:names:tc:SAML:2.0:ac:classes (SAML 2.0) or
• urn:oasis:names:tc:SAML:1.2:ac:classes (SAML 1.2)

For example, to use the Password value for SAML 2.0, enter: urn:oasis:names:tc:SAML:2.0:ac:classes:Password

For more information about SAML 2.0 authentication context classes, see the SAML 2.0 specification.  

Authentication context comparison

This field maps to the authnContextComparison attribute. It specifies the comparison method used to evaluate the requested context class (AuthnContextClassRef). If this parameter is omitted, its value defaults to EXACT. When the parameter is specified, it must be populated with any of the Valid values listed in the table below.

For more information about the AuthnContextComparison method, see the SAML 2.0 specification.

Authentication digest method

This field maps to the requestAuthnDigestMethod attribute. It performs a checksum of the contents of the SAML request to ensure it was not edited in transit. If this parameter is omitted, its value defaults to http://www.w3.org/2001/04/xmlenc#sha256. When the parameter is specified, it must be populated with any of the Valid values listed in the table below.

For more information about digest algorithms, see the W3 XML Security Algorithm Cross-Reference.

Authentication signature method

This field maps to the requestAuthnSignatureMethod attribute. It is a cryptographic signature algorithm for the checksum of the contents of the SAML request. The signature algorithm should match the digest algorithm with a variety of pre-pended private key generation indicators. If this parameter is omitted, its value defaults to http://www.w3.org/2001/04/xmldsig-more#rsa-sha256. When the parameter is specified, it must be populated with any of the Valid values listed in the table below.

For more information about signature algorithms, see the W3 XML Security Algorithm Cross-Reference.

Troubleshooting

AADSTS75011 error in Azure

When signing in to CrashPlan using Azure for SSO, you may receive the following error message:

Error - AADSTS75011 Authentication method by which the user authenticated with the service doesn't match requested authentication method AuthnContextClassRef. 

This error occurs when the authentication method by which the user authenticated with the Azure instance doesn't match the requested authentication method set in CrashPlan in the authentication context class reference field (AuthnContextClassRef). For example, this can occur when the "Password" value is set in CrashPlan, and the Azure instance uses the "Multifactor" value. For more information about the error, see the Microsoft documentation.

To resolve the issue, edit the SAML attributes to delete the value in the Authentication context class reference field. A blank string in the field allows Azure to use the authentication method it is already configured to use.

External resources

• Wikipedia: SAML 2.0
• OASIS (official home of SAML)
  • OASIS SAML wiki
  • SAML 2.0 standard
  • SAML 2.0: RequestedAuthnContext
  • SAML 2.0: Schemas 
• W3 XML Security Algorithm Cross-Reference