Authentication

Control-M supports the following methods to authenticate Control-M users:

  • Control-M: Authenticates individual users that are created manually within Control-M, as described in Creating an Internal User.

  • Identity Provider (SAML 2.0 IdP): Authenticates multiple external users with a single configuration, as described in Configuring Authentication with a SAML 2.0 IdP. IdP supports Multi-factor Authentication (MFA) configured in the IdP and Single Sign-on (SSO). You can configure authentication to one IdP. Control-M supports any SAML 2.0 compliant IdP, such as Okta, Microsoft Entra ID (Azure AD), Active Directory Federation Services (ADFS), and Ping Federate/Ping Identity.

If you are using both local and external authentication, BMC recommends that you create local usernames that are unique and do not duplicate existing external usernames.

Configuring Authentication with a SAML 2.0 IdP

This procedure describes how to configure authentication with a SAML 2.0 Identity Provider (IdP) for all Control-M users. This enables you to authenticate multiple external users with a single configuration, instead of multiple individual internal users in Control-M.

Before You Begin

  • Designate a local emergency user (emuser or any internal admin) and verify that the password is valid before you enable SAML. This user is your fallback if the IdP is misconfigured.

  • Confirm time synchronization (NTP) between Control-M/EM server and the IdP.

  • Verify that you have the rollback path /local URL, util -disableIdp, and the local emergency user information available.

Begin

  1. From the icon, select Configuration.

    The Configuration domain opens.

  2. From the drop-down list, select System Settings.

    The System Settings dialog box appears.

  3. From the Identity Provider (IdP) tab, toggle on Enable SAML 2.0.

  4. (Optional) Toggle on Force Authentication if you want to force users to re-authenticate in the IdP at each login, even if they have an active SSO session in the IdP.

  5. Click to copy the following Service Provider values, and paste each value into your IdP application configuration.

    • Single Sign-On URL: Defines the URL where the IdP posts the SAML response in the following format:

      https://<em-host>:<port>/services-proxy/idpcallback

    • Audience URI (Service Provider Entity ID): Defines the Service Provider URI that the IdP uses to verify the request for Control-M.

    • Signing Certificate: Defines the certificate that the IdP uses it to validate signed requests and responses from Control-M.You can download the signing certificate from the following location:

      https://<em host>:port/saml/sp-metadata

  6. Copy the Single Sign-On URL value and paste it in the Single Logout URL field in your IdP application configuration and replace the string idpresponse with logout at the end of the Single Logout URL.

  7. From your IdP, define the ExternalIDPGroups and username attributes.

    The attribute values are case-sensitive and must be identical to those used in Control-M. The attribute name in the IdP and the value of idp.saml.idpGroupsClaim must be identical and case-sensitive. If they do not match, the SAML assertion is accepted but the authorization fails since user has no groups.

  8. From your IdP, generate the XML metadata file and do one of the following:

    • Click Select File and browse for the XML metadata file on your host.

    • In the XML Metadata for SAML Service Provider field, type the XML metadata file endpoint URL.

    If you disable SAML 2.0, you cannot remove the XML metadata file.

  9. After you have completed this procedure, you must map the groups from the IdP to rolesClosed An authorization entity that grants permissions to associated users to access different functionality., as described in Adding a Role.

    All Control-M users that connect to Control-M SaaS are now authenticated with SAML 2.0. Automation APIClosed A set of programmatic interfaces that provides developers and DevOps engineers access to the capabilities of Control-M SaaS within the modern application release process. is authenticated via tokensClosed An authorization entity, required during Agent installation, which enables you to connect the Agent to your Control-M SaaS backend.. Internal users are not managed in IdP mode. Emergency users are assigned to Admin roles and are listed in the Emergency Users list. All Control-M users that access CLI utilities are authenticated with user and password and not with SAML 2.0.

  10. Log in with the Emergency URL (<tenant_name>-emergency), copy the Admin role, and update it with groups from your IdP, as described in Adding a Role.

  11. Add new roles or update existing roles with groups from your IdP.