Item	Details
Prior Confirmation	Prior configuration in Nutanix Frame is required. The setup steps in this manual have been verified by us, but for the latest information and setup instructions, please check the manual provided by Nutanix Frame. Note: The JIT feature is a technical preview at Nutanix and is therefore not covered by support.
Name ID	〇	Email address
		Custom attribute　Note: For how to configure a custom attribute, click here
SP-side Configuration	〇	Configured by the administrator
		Request configuration from the SP
Provisioning		Provisioning via API supported (account management possible in TrustLogin)
	〇	SAML JIT provisioning supported (account management possible in TrustLogin; user deletion not supported)
		None (accounts are created in each system)
Access Method	〇	SP-Initiated SSO
	〇	IdP-Initiated SSO
Verified Operation by Device	〇	PC - Browser
	ー	PC - Desktop App
	〇	iOS - Standard Browser (Safari)
	ー	iOS - TrustLogin Mobile App In-App Browser
	ー	iOS - Native App
	〇	Android - Standard Browser (Chrome)
	ー	Android - TrustLogin Mobile App In-App Browser
	ー	Android - Native App

Preparation

When logging in to Nutanix Frame via SAML authentication, user information is synchronized to Nutanix Frame through JIT provisioning. Please complete the following configuration in advance.

Create a Group and Assign Members

Create a group to map to a Nutanix Frame role and assign members to it.
(If an existing group can be used for this purpose, an existing group is fine.)
The group name can be anything you choose.

Please refer to the following page for how to create a group and assign members.
Registering a Group

[Configuration Example]

• Create a "General User" group and assign members of the Nutanix Frame "Launchpad User on Application" role
• Create an "Administrator" group and assign members of the Nutanix Frame "Account Administrator" role

With this configuration, for example, when a user belonging to "Administrator" logs in to Nutanix Frame via SAML, the "Account Administrator" role is automatically assigned. If you change a user's group in TrustLogin, the role on the Nutanix Frame side will also change the next time they log in via SAML. Users who do not belong to a configured group will not be able to log in to Nutanix Frame.

TrustLogin Admin Page Configuration

1. Log in to TrustLogin here, open the "Admin Page > App" menu, and click the "Register SAML App" button at the top right of the screen.
   
   
   
2. Configure the "Application Name" and "Icon" (optional).
   
   
   
3. Download the metadata under "Identity Provider Information".
   

Now, switch over to configuring the Nutanix Frame side.
Do not click the "Register" button yet — open Nutanix Frame in a separate tab.

Nutanix Frame Configuration

1. Log in to Nutanix Frame with an administrator account and select the target for which you want to configure SAML authentication.
   (There are three types — Accounts, Organization, and Customer — but the configuration method is the same. Here, we will use Accounts as an example to configure SAML.)
   
   
   
2. Open "Users".
   
   
   
3. From the "Authentication" tab, turn on the "SAML2" toggle and save by clicking "Save".
   
   
   
4. On the "SAML2 Providers" tab, click "AddSAML2 Providers".
   
   
   
5. Configure the items as follows, and finally click "Add".
   

   Application Id	Any string you choose (you will enter this into TrustLogin later)
   Auth provider metadata	Open the metadata downloaded from TrustLogin in a text editor and paste in its contents.
   Integration Name	Any string you choose (you will enter this into TrustLogin later) Note: The string you set here will later be displayed on the Nutanix Frame login screen. See the image below.
   Custom Label (optional)	Any string you choose Note: The string you set here will later be displayed on the Nutanix Frame login screen. If left blank, the ID configured in "Integration Name" will be displayed. See the image below.
   Signed assertion	Turn the toggle on

   
   
   
   
   

6. On the "SAML2Permissions" tab, click "AddPermission".
   
   
   

7. Configure the items as follows, and finally click "Save".

   For provider	From the dropdown, select the "Integration Name" you configured in step 5.
   Description (optional)	Enter a description that explains the purpose of this setting.
   Allow access	Select "When all conditions are satisfied"
   Conditions	Enter as text or select from the dropdown, in this order: "groups" - "contains" - "Text" - "the TrustLogin group name".
   Grant roles	Configure the role to assign to the group specified in Conditions.

   
   Example: Assigning the "Launchpad User on application" role to the "General User" group
   

8. Repeat steps 6-7 for each group that needs to be configured.
   

Now return to configuring TrustLogin again.

TrustLogin Admin Page Configuration (Continued)

1. Configure each item of the "Login URL" under "Service Provider Settings" in the following format. For the URL after successful authentication, copy the URL from the address bar of the page you want to display after SAML login.
   
   

   https://[URL after successful authentication]?idp=["Integration Name" you configured in Nutanix Frame]

   
   Example) https://console.nutanix.com/test/tlustlogin/gmoglobalsign/launchpad/application?idp=Globalsign
   
   [Reference Examples of Each Page URL]
   

   Launchpad	https://console.nutanix.com/[Your URL]/launchpad/[Your URL]
   Admin Page	https://console.nutanix.com/frame/[Your URL]/

   
   Example: If you want to display Launchpad after SAML login
   
   
   
   
   
2. Configure the other items under "Service Provider Settings" as follows.
   

   Value for Name ID	[Member]-[email]
   Entity ID	Any string you entered in the "Application Id" field in Nutanix Frame
   Name ID Format	Select "persistent"
   ACS URL to Service	https://img.frame.nutanix.com/saml2/done/[Any string you entered in the "Integration Name" field in Nutanix Frame]/ Example) https://img.frame.nutanix.com/saml2/done/Globalsign/

   
   
   
   
3. Add a row (attribute) using the "Add SAML Attribute" button in "SAML Attribute Settings" and configure it as follows.
   For the group attribute value, select a group name from the dropdown; you can add multiple entries using the "＋" mark on the right.
   

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Name	Attribute Type	Attribute Name		Attribute Value
   givenName	Basic	givenName	Member	Member First Name
   sn	Basic	sn	Member	Member Last Name
   mail	Basic	mail	Member	Member Email Address
   groups	Basic	groups	Group	Select the group name you configured and add it using the "＋" button

   
   
   
   
4. Save by clicking the "Register" button.
   
   

TrustLogin User Configuration

① When a User Adds the App via My Page

1. Click the "Add App" button on "My Page".
2. On the "App Registration" screen, select the custom SAML app you created, and click the "Next" button at the top right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.
4. Click the app on "My Page" or in the browser extension and confirm that login succeeds.

② When an Administrator Adds a Member

1. Search for and click the custom SAML app you created in the "Admin Page > App" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.

About Logout

If you try to log out on the Nutanix Frame side, you will be automatically logged back in.
If you want to log out of Nutanix Frame, please log out of TrustLogin instead.