The Adobe Admin Console allows a system administrator to configure domains and directories which are used for login via Federated ID for Single Sign-On (SSO). Once ownership of a domain is demonstrated using a DNS token and it has been linked to a Federated ID directory, users who have e-mail addresses within the claimed domain can log in to Creative Cloud via an Identity Provider system (IdP) once corresponding accounts have been created on the relevant Adobe Admin Console. The process is provisioned either as a software service which runs within the company network and is accessible from the Internet or a cloud service hosted by a third party that allows for the verification of user login details via secure communication using the SAML protocol.
One such IdP is Microsoft Azure, a cloud-based service which facilitates secure identity management.
The Azure AD uses the userPrincipalName attribute or allows you to specify the attribute (in a custom installation) to be used from on-premises as the user principal name in Azure AD. If the value of the userPrincipalName attribute does not correspond to a verified domain in Azure AD, it will be replaced with a default .onmicrosoft.com value.
When a user authenticates to the application, Azure AD issues a SAML token to the app that contains information (or claims) about users that uniquely identifies them. By default, this information includes a user's username, email address, first name, and last name. You can view or edit the claims sent in the SAML token to the application under the Attributes tab and release the user name attribute.
Before configuring a domain for single sign-on using Microsoft Azure as the IdP, the following requirements must be met:
- An approved domain within an existing directory on your Adobe admin console. The status of the directory in the Adobe Admin Console must be Configuration Required, or it can be an existing directory which has previously been configured.
- Microsoft Azure dashboard is accessible and you are logged in as an administrator able to create a new enterprise application
-
Note:
As shown in the above screenshot, we suggest using e-mail address as the primary identifier. The use of the User Principal Name (UPN) field as the LDAP attribute sent in an assertion as the e-mail address is not reccomended. Whilst it is possible to use UPN as the LDAP attribute, this is not an officially supported configuration, and you do so at your own risk.
Often the UPN does not map to an e-mail address, and will in many cases be different. This will most likely cause problems for notifications and sharing of assets within Creative Cloud.
-
- Use the URL of the EntityID from the metadata in the Identifier field in your Azure configuration:
This address takes the following form: https://www.okta.com/saml2/service-provider/spi1t5qdd3rI7onSl0x78 - Use the URL of the AssertionConsumerService for the Reply URL in your Azure configuration
This address takes the following form: https://adbe-example-dot-com-a8bd-prd.okta.com/auth/saml20/accauthlinktest
- Use the URL of the EntityID from the metadata in the Identifier field in your Azure configuration:
To assign users via Microsoft Azure to permit them to log in using the Adobe Creative Cloud connector, perform the steps below. Note that you will still need to assign licenses via the Adobe admin console.
-
Ensure that you assign the users via Azure.
-
Also, ensure that you add users within the Adobe Admin console as Federated ID and assign them to a group for entitlement.
-
At this point, type your email address/upn into the Adobe sign-in form, press tab, and you are federated back to Azure AD:
- In a web browser: www.adobe.com click sign in at the top right corner of the page
- Within the Creative Cloud Desktop application
- From an Adobe Creative Cloud application such as Photoshop or Illustrator from the menu Help > Sign in...
Twitter™ and Facebook posts are not covered under the terms of Creative Commons.