SAML reference

Configuration fields, service provider values, and technical specifications

Print user authentication fields

Configured under Account Settings → Settings → User Authentication Providers → SAML 2.0.

Dynamic configuration

Field Required Description
Entity ID Yes The unique URL identifying the identity provider, also called the Issuer. In Azure: Microsoft Entra Identifier. Typically starts with https://sts.windows.net.
Metadata Location Yes URL where the identity provider's SAML metadata is hosted. Pharos Cloud retrieves SSO URL, certificate, and endpoints automatically. In Azure: App Federation Metadata URL. Must be publicly accessible.
Email Field No The assertion attribute containing the user's email address. Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. Change only if your identity provider uses a non-standard attribute name.

Manual configuration

Field Required Description
Entity ID Yes Unique URL identifying the identity provider.
Single Sign-In URL Yes URL where HP Insights redirects users to authenticate.
Signing Certificate Yes X.509 certificate from the identity provider. Used to validate assertion signatures. Must be updated whenever the identity provider rotates its certificate.
Single Sign-Out URL No URL where users are redirected on logout. If empty, users are logged out of HP Insights only.
Email Field No Assertion attribute containing the email address. Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
Sign Authentication Request No Whether HP Insights signs the initial authentication request. Default: Yes.

HP Insights service provider values

When configuring your identity provider, use these values for theHP Insights service provider. Download the full SAML metadata file from Account Settings → Settings → User Authentication Providers → SAML Metadata.

Value Description
ACS URL The HP Insights endpoint where the identity provider sends the SAML assertion. Found in the SAML metadata file under AssertionConsumerService Location. Examples:
  • https://www.beacon.pharos.com/SAML2/AssertionConsumerService
  • https://beacon.pharos.com/SAML2/AssertionConsumerService
In Azure, this is the Reply URL (Assertion Consumer Service URL).
Entity ID The unique identifier for HP Insights as a service provider. Found in the metadata file as the entityID parameter. In Azure, this is the Identifier (Entity ID).
X.509 Certificate HP Insights's public certificate. Used by the identity provider to validate signed authentication requests. Found in the metadata file as the X509Certificate value.
Binding HTTP POST for SSO. HTTP Redirect for logout.
Initiation type SP-initiated only. IdP-initiated SSO is not supported.
SAML version SAML 2.0 only.

Microsoft Entra ID field mapping

Quick reference for translating between HP Insights terminology and Microsoft Entra ID.

HP Insights Microsoft Entra ID Direction
Entity ID (IdP) Microsoft Entra Identifier Azure → HP Insights
Single Sign-In URL Login URL Azure → HP Insights
Single Sign-Out URL Logout URL Azure → HP Insights
Metadata Location App Federation Metadata URL Azure → HP Insights
ACS URL Reply URL (Assertion Consumer Service URL) HP Insights → Azure
Entity ID (SP) Identifier (Entity ID) HP Insights → Azure

SAML SSO error codes

The following error codes are returned by the HP Insights Identity Service during SAML sign-in and sign-out. Use these codes to identify the cause of authentication failures.

Code Error
8000 InvalidSamlProviderConfiguration — The SAML provider configuration is invalid. Check all fields in the SAML configuration for missing or incorrect values.
8001 UnknownSamlSsoSignInError — An unexpected error occurred during SAML sign-in. Contact HP Support.
8002 InvalidSamlSsoSignInResponseError — The SAML response received from the identity provider is invalid. Verify the ACS URL and signing certificate are correct.
8003 UnknownSamlSsoSignOutError — An unexpected error occurred during SAML sign-out. Contact HP Support.
8004 InvalidSamlSsoSignOutResponseError — The SAML sign-out response is invalid. Verify the Single Sign-Out URL is correctly configured.
8005 SamlProviderConfigurationNotInitializedError — The SAML provider has not been initialised. Save the SAML configuration and try again.
8006 InvalidSamlProviderIdError — The identity provider ID in the assertion does not match the configured Entity ID. Verify the Entity ID in the SAML configuration.
8007 SamlUserEmailNotFoundError — The SAML assertion does not contain an email address. Verify the Email Field (or Email Attribute Name) matches the attribute your identity provider uses to send the email address.
8008 InvalidSamlSsoSignInEmailKeyNotFoundError — The email key specified in the configuration was not found in the assertion. Check the Email Field value in the SAML configuration.
8009 InvalidSamlSsoSignInPathError — The sign-in path in the SAML response is invalid. Contact HP Support.
8010 InvalidSamlSsoSignInEmptyAssertionError — The SAML assertion returned by the identity provider is empty. Verify the identity provider is correctly configured to return assertions and that the signing certificate is current.