Plan
Adobe offers the following identity types:
- Enterprise ID: Organization creates and owns account. The accounts are created on a claimed domain. Adobe manages credentials and processes sign-in.
- Federated ID: Organization creates and owns account, links with enterprise directory via federation, enterprise company, or school manages credentials and processes sign-in via Single Sign-On.
- Adobe ID: User creates and owns account. Adobe manages credentials and processes sign-in. Depending on the storage model, user or organization owns the account and assets.
Yes, you can have a mix of Enterprise IDs, Federated IDs, and Adobe IDs, but not within the same claimed domain.
Enterprise ID and Federated ID are exclusive at the domain level. Therefore, you can choose only one of them. You can use Adobe ID in conjunction with either Federated ID or Enterprise ID.
For example, if an Enterprise claims only one domain, the IT Administrator can choose either Enterprise ID or Federated ID. If an organization claims multiple domains within an Enterprise, the IT Administrator can use one domain with Adobe IDs and Enterprise IDs, and another domain with Adobe IDs and Federated IDs, and so on. That means, for each domain, you can either have Enterprise ID or Federated ID along with Adobe ID.
Management of Adobe licenses under Federated ID is faster, easier, and more secure.
- IT administrators control authentication and the user lifecycle.
- When you remove a user from the enterprise directory, the user no longer has privileges to access the desktop apps, services, or mobile apps.
- Federated IDs allow organizations to leverage user identity management systems already in place.
- Because your end-users use your organization's standard identity system, IT doesn't have to manage a separate password management process.
When signing in, your end users are redirected to your organization's standard – and familiar – Single Sign-On experience.
Yes. You can switch over from Enterprise to Federated IDs using the same domain. For details, see how to move domain across directories.
Yes, you can federate your enterprise directory and its login and authentication infrastructure with Adobe using your SAML 2.0 compliant identity provider.
No. When a domain is claimed for Federated IDs, nothing changes to existing Adobe IDs with email addresses in that domain. Existing Adobe IDs in the Admin Console are preserved.
Adobe uses the secure and widely adopted industry standard Security Assertion Markup Language (SAML), which means the implementation of SSO integrates easily with any identity provider that supports SAML 2.0.
#If your identity provider is Microsft Azure AD or Google, you can skip the SAML-based method and use the Azure AD Connector or the Google Federation SSO to set up SSO with the Adobe Admin Console respectively. These setups are established and managed using the Adobe Admin Console and use a sync mechanism to manage user identities and entitlements.
Yes, as long as it follows the SAML 2.0 protocol.
Yes and the identity provider must be SAML 2.0 compatible.
At a minimum, your SAML identity provider must have:
- IDP Certificate
- IDP Login URL
- IDP Binding: HTTP-POST or HTTP-Redirect
- The Assertion Consumer Service URL of the IDP and it must be able to accept SAML requests and RelayState.
Check with your identity provider if you have further questions.
How to
No, you cannot reset passwords for Federated IDs using the Adobe Admin Console. Adobe does not store user credentials. Use your Identity Provider for user management.
Common questions: Directory setup
Find answers to your questions related to directory migration to a new authentication provider and updating a deprecated SAML setup.
Before you start, ensure you meet the access requirements to follow the procedure for migrating to a different identity provider. Also, consider the following points to ensure a seamless and error-free migration for your organization's directories:
- Admins must create a new SAML app in their IdP setup to configure it. If they edit the existing app, it will overwrite any active configuration, cause downtime, and nullify the ability to switch between available IdPs in the Adobe Admin Console.
- Admins must ensure that all required users are assigned to or can use the newly created SAML app.
- Admins must ensure that the username format for the new authentication profile in their IdP matches the format used by the existing profile for user login. They can use the Test feature provided on the authentication profile to verify. This Test link can be copied to the clipboard and shared with others to validate from their machines.
- Admins should test the newly added IdP prior to activation using 2 to 3 active accounts from the directory.
Error logs will not be available for these features. However, the Test workflow allows the Admin to validate relevant errors prior to activation. Limitations to consider include:
- One directory can have up to two authentication profiles, and both the profiles should be for different authentication types. This means Microsoft Azure AD (which uses Open ID Connect) can stay with Other SAML providers, but Google (which itself uses SAML) cannot stay with Other SAML providers in the same directory.
- This feature does not allow admins to migrate their identity provider to enable directory sync functionality (Azure AD Connector and Google Connector). Although customers migrating to Microsoft Azure or Google as their IdP can utilize a different form of user management strategy. To learn more, see Adobe Admin Console users.
