Navodila za uporabo Prekliči

Single Sign-On common questions

  1. Adobe za podjetja in skupine: vodnik za skrbništvo
  2. Načrtovanje uvedbe
    1. Osnovni pojmi
      1. Licenciranje
      2. Identiteta
      3. Upravljanje uporabnikov
      4. Uvedba programov
      5. Pregled konzole Admin Console
      6. Skrbniške vloge
    2. Vodniki za uvedbo
      1. Vodnik za uvedbo imenovanih uporabnikov
      2. Vodnik za uvedbo licenciranja naprave v skupni rabi
      3. Uvedba programa Adobe Acrobat 
    3. Uvedba storitve Creative Cloud za izobraževalne ustanove
      1. Začetna stran za uvajanje
      2. Čarovnik za uvajanja za osnovno- in srednješolsko izobraževanje
      3. Preprosta nastavitev
      4. Sinhronizacija uporabnikov
      5. Roster Sync K-12 (ZDA)
      6. Najpomembnejši pojmi glede licenciranja
      7. Možnosti uvajanja
      8. Hitri nasveti
      9. Odobritev programov Adobe v storitvi Admin Console v Googlu
      10. Omogočanje programa Adobe Express v Učilnici Google
      11. Integracija s storitvijo Canvas LMS
      12. Integracija s storitvijo Blackboard Learn
      13. Konfiguriranje enkratne prijave za okrožne portale in storitve LMS
      14. Dodajanje uporabnikov s storitvijo Roster Sync
      15. Pogosta vprašanja o storitvi Kivuto
      16. Smernice za upravičenost glavnih in pomožnih ustanov
  3. Nastavitev organizacije
    1. Vrste identitet | Pregled
    2. Nastavitev identitete | Pregled
    3. Nastavitev organizacije z Enterprise ID-jem
    4. Nastavitev združevanja in sinhronizacije storitve Azure AD
      1. Nastavitev enkratne prijave z Microsoftom prek storitve Azure OIDC
      2. Dodajanje storitve Azure Sync v imenik
      3. Sinhronizacija vlog za izobraževanje
      4. Pogosta vprašanja o storitvi Azure Connector
    5. Nastavitev združevanja in sinhronizacije Google
      1. Nastavitev enkratne prijave z združevanjem Google
      2. Dodajanje sinhronizacije Google v imenik
      3. Pogosta vprašanja o združevanju Google
    6. Nastavitev organizacije s storitvijo Microsoft ADFS
    7. Nastavitev organizacije za okrožne portale in LMS
    8. Nastavitev organizacije z drugimi ponudniki identitet
      1. Ustvarjanje imenika
      2. Preverjanje lastništva domene
      3. Dodajanje domen v imenike
    9. Pogosta vprašanja o enkratni prijavi in odpravljanju težav
      1. Pogosta vprašanja o enkratni prijavi
      2. Odpravljanje težav pri enkratni prijavi
      3. Pogosta vprašanja o izobraževanju
  4. Upravljanje nastavitve organizacije
    1. Upravljanje obstoječih domen in imenikov
    2. Omogočanje samodejnega ustvarjanja računa
    3. Nastavitev organizacije prek zaupanja imenika
    4. Selitev na novega ponudnika preverjanja pristnosti 
    5. Nastavitve sredstev
    6. Nastavitve preverjanja pristnosti
    7. Stiki za zasebnost in varnost
    8. Nastavitve konzole
    9. Upravljanje šifriranja  
  5. Upravljanje uporabnikov
    1. Pregled
    2. Skrbniške vloge
    3. Strategije upravljanja uporabnikov
      1. Upravljanje posameznih uporabnikov   
      2. Upravljanje več uporabnikov (skupinska datoteka CSV)
      3. Orodje za sinhronizacijo uporabnikov
      4. Sinhronizacija Microsoft Azure
      5. Sinhronizacija združevanja Google
    4. Dodelitev licenc uporabniku računa za skupine
    5. Dodajanje uporabnikov z ustreznimi e-poštnimi domenami
    6. Sprememba vrste identitete uporabnika
    7. Upravljanje uporabniških skupin
    8. Upravljanje uporabnikov imenika
    9. Upravljanje razvijalcev
    10. Selitev obstoječih uporabnikov v storitev Adobe Admin Console
    11. Selitev upravljanja uporabnikov v storitev Adobe Admin Console
  6. Upravljanje izdelkov in pravic
    1. Upravljanje izdelkov in profilov izdelkov
      1. Upravljanje izdelkov
      2. Nakup izdelkov in licenc
      3. Upravljanje profilov izdelkov za poslovne uporabnike
      4. Upravljanje pravil samodejnega dodeljevanja
      5. Omogočite uporabnikom učenje modelov Firefly po meri
      6. Pregled zahtev za izdelke
      7. Upravljanje samopostrežnih pravilnikov
      8. Upravljanje integracij programov
      9. Upravljanje dovoljenj za izdelke v storitvi Admin Console  
      10. Omogočanje/onemogočanje storitev za profil izdelka
      11. En program | Creative Cloud za podjetja
      12. Izbirne storitve
    2. Upravljanje licenc za naprave v skupni rabi
      1. Novosti
      2. Vodnik za uvedbo
      3. Ustvarjanje paketov
      4. Obnovitev licenc
      5. Upravljanje profilov
      6. Komplet orodij za licenciranje
      7. Pogosta vprašanja o licenciranju naprav v skupni rabi
  7. Predstavitev konzole Global Admin Console
    1. Uvedba globalnega skrbništva
    2. Izbira organizacije
    3. Upravljanje hierarhije organizacije
    4. Upravljanje profilov izdelkov
    5. Upravljanje skrbnikov
    6. Upravljanje skupin uporabnikov
    7. Posodobitev pravilnikov organizacije
    8. Upravljanje predlog pravilnikov
    9. Dodelitev izdelkov podrejenim organizacijam
    10. Izvajanje čakajočih opravil
    11. Raziskovanje vpogledov
    12. Izvoz ali uvoz strukture organizacije
  8. Upravljanje prostora za shranjevanje in sredstev
    1. Prostor za shranjevanje
      1. Upravljanje shrambe podjetja
      2. Adobe Creative Cloud: Posodobitev na shrambo
      3. Upravljanje prostora za shranjevanje Adobe
    2. Selitev sredstev
      1. Avtomatizirana selitev sredstev
      2. Pogosta vprašanja o avtomatizirani selitvi sredstev  
      3. Upravljanje prenesenih sredstev
    3. Povrnitev sredstev od uporabnika
    4. Selitev sredstev študentov | Samo za izobraževanje
      1. Samodejna selitev sredstev študentov
      2. Selitev lastnih sredstev
  9. Upravljanje storitev
    1. Adobe Stock
      1. Paket kreditnih točk Adobe Stock za skupine
      2. Adobe Stock za podjetja
      3. Uporaba storitve Adobe Stock za podjetja
      4. Odobritev licence za Adobe Stock
    2. Pisave po meri
    3. Adobe Asset Link
      1. Pregled
      2. Ustvarjanje uporabniške skupine
      3. Konfiguracija storitve Adobe Experience Manager Assets
      4. Konfiguracija in namestitev storitve Adobe Asset Link
      5. Upravljanje sredstev
      6. Adobe Asset Link za XD
    4. Adobe Acrobat Sign
      1. Nastavitev storitve Adobe Acrobat Sign za podjetja ali skupine
      2. Adobe Acrobat Sign – skrbnik funkcije skupine
      3. Upravljanje storitve Adobe Acrobat Sign v storitvi Admin Console
    5. Creative Cloud za podjetja – brezplačno članstvo
      1. Pregled
  10. Uvedba programov in posodobitev
    1. Pregled
      1. Uvedba in zagotavljanje programov in posodobitev
      2. Načrtovanje uvedbe
      3. Priprava na uvedbo
    2. Ustvarjanje paketov
      1. Ustvarjanje paketov programov v storitvi Admin Console
      2. Ustvarjanje licenčnih paketov imenovanih uporabnikov
      3. Predloge Adobe za pakete
      4. Upravljanje paketov
      5. Upravljanje licenc za naprave
      6. Licenciranje serijske številke
    3. Prilagoditev paketov
      1. Prilagoditev namiznega programa Creative Cloud
      2. Vključitev razširitev v paket
    4. Uvedba paketov 
      1. Uvedba paketov
      2. Uvedba paketov Adobe s storitvijo Microsoft Intune
      3. Uvedba paketov Adobe z upraviteljem SCCM
      4. Uvedba paketov Adobe s storitvijo ARD
      5. Namestitev izdelkov v mapo za izjeme
      6. Odstranitev izdelkov Creative Cloud
      7. Uporaba Adobejevega kompleta orodij za zagotavljanje (izdaja za podjetja)
      8. Identifikatorji licenciranja za Adobe Creative Cloud
    5. Upravljanje posodobitev
      1. Upravljanje sprememb za Adobejeve stranke podjetij in skupin
      2. Uvedba posodobitev
    6. Nastavitveno orodje strežnika za posodabljanje Adobe (AUSST)
      1. Pregled orodja AUSST
      2. Nastavitev notranjega strežnika za posodabljanje
      3. Vzdrževanje notranjega strežnika za posodabljanje
      4. Pogosti primeri uporabe orodja AUSST   
      5. Odpravljanje težav z notranjim strežnikom za posodabljanje
    7. Adobe Remote Update Manager (RUM)
      1. Uporaba programa Adobe Remote Update Manager
      2. Odpravljanje napak v programu RUM
    8. Odpravljanje težav
      1. Odpravljanje napak pri namestitvi in odstranjevanju programov Creative Cloud
      2. Poizvedba v odjemalskih računalnikih za preverjanje uvedbe paketa
      3. Sporočilo o napaki »Namestitev ni uspela« za paket Creative Cloud
  11. Upravljanje računa za skupine
    1. Pregled
    2. Posodobitev podatkov za plačilo
    3. Upravljanje izdanih računov
    4. Sprememba lastnika pogodbe
    5. Zamenjava paketa
    6. Zamenjava prodajalca
    7. Preklic paketa
    8. Skladnost zahteve za nakup
    9. Upravljanje skupine v programu Adobe Express
  12. Podaljšanje
    1. Članstvo za skupine: podaljšanje
    2. Podjetja v storitvi VIP: podaljšanje in skladnost
  13. Upravljanje pogodb
    1. Avtomatizirane faze izteka za pogodbe ETLA
    2. Zamenjava vrste pogodbe v obstoječi storitvi Adobe Admin Console
    3. Value Incentive Plan (VIP) na Kitajskem
    4. Pomoč za VIP Select
  14. Poročila in dnevniki
    1. Revizijski dnevnik
    2. Poročila o dodelitvi
    3. Dnevniki vsebine
  15. Pomoč
    1. Stik z Adobejevo službo za skrb za stranke
    2. Možnosti podpore za račune za skupine
    3. Možnosti podpore za račune za podjetja
    4. Možnosti podpore za rešitev Experience Cloud

The Adobe Admin Console offers a method for enterprise users to authenticate with Adobe enterprise offerings using their existing identity management systems via integration with Single Sign-On (SSO) enabled identity management systems. Single Sign-On is enabled using SAML, an industry-standard protocol which connects enterprise identity management systems to cloud service providers like Adobe. SSO can securely exchange authentication information between two parties: the service provider (Adobe) and your Identity Provider (IdP). The service provider sends a request to your IdP, which attempts to authenticate the user. After authentication, the IdP sends a response message to sign the user in. For detailed instructions, see Configure Single Sign-On.

Plan

Adobe offers the following identity types:

  • Enterprise ID: Organization creates and owns account. The accounts are created on a claimed domain. Adobe manages credentials and processes sign-in.
  • Federated ID: Organization creates and owns account, links with enterprise directory via federation, enterprise company, or school manages credentials and processes sign-in via Single Sign-On.
  • Adobe ID: User creates and owns account. Adobe manages credentials and processes sign-in. Depending on the storage model, user or organization owns the account and assets.
Opomba:

We're updating organizations (teams or enterprises) to the Enterprise storage model to enable enterprise storage and other enterprise-level features for Adobe ID users.

You'll be notified when your organization is scheduled for the update. After the update, the Adobe ID users are moved to enterprise storage, and the organization directly controls their business profiles.

Yes, you can have a mix of Enterprise IDs, Federated IDs, and Adobe IDs, but not within the same claimed domain.

Enterprise ID and Federated ID are exclusive at the domain level. Therefore, you can choose only one of them. You can use Adobe ID in conjunction with either Federated ID or Enterprise ID.

For example, if an Enterprise claims only one domain, the IT Administrator can choose either Enterprise ID or Federated ID. If an organization claims multiple domains within an Enterprise, the IT Administrator can use one domain with Adobe IDs and Enterprise IDs, and another domain with Adobe IDs and Federated IDs, and so on. That means, for each domain, you can either have Enterprise ID or Federated ID along with Adobe ID.

Management of Adobe licenses under Federated ID is faster, easier, and more secure.

  • IT administrators control authentication and the user lifecycle.
  • When you remove a user from the enterprise directory, the user no longer has privileges to access the desktop apps, services, or mobile apps.
  • Federated IDs allow organizations to leverage user identity management systems already in place.
  • Because your end-users use your organization's standard identity system, IT doesn't have to manage a separate password management process.

When signing in, your end users are redirected to your organization's standard – and familiar – Single Sign-On experience.

Yes. You can switch over from Enterprise to Federated IDs using the same domain. For details, see how to move domain across directories.

Yes, you can federate your enterprise directory and its login and authentication infrastructure with Adobe using your SAML 2.0 compliant identity provider.

No. When a domain is claimed for Federated IDs, nothing changes to existing Adobe IDs with email addresses in that domain. Existing Adobe IDs in the Admin Console are preserved.

Asset Migration is an automated process. When you initiate this process, all the supported content that is currently stored in your Adobe ID account is migrated to your Enterprise/Federated ID account. To learn more, see Automated Asset Migration.

Adobe’s Federated ID implementation supports authorization; authentication is handled by your Identity Provider (IdP).

As an enterprise organization, you can create a link between your authentication services (utilizing a corporate ID structure such as Active Directory) and Adobe's. This allows the enterprise organization to host the authentication. Adobe never stores passwords and IT administrators cannot reset passwords or edit user names for Federated IDs via the Adobe Admin Console.

Yes, via the Import Users functionality available from within the Adobe Admin Console. For more information, see Adding multiple users.

No. Adobe interfaces with your identity provider and not directly to your enterprise directory. However, we support importing user and group information from your enterprise directory into the Adobe Admin Console. For more information, see Adding multiple users.

Adobe recommends that all enterprise admins switch their Adobe ID users to Federated IDs. You can migrate from Adobe IDs to Federated IDs using these steps.

Adobe uses the secure and widely adopted industry standard Security Assertion Markup Language (SAML), which means the implementation of SSO integrates easily with any identity provider that supports SAML 2.0.

Following is a list of some IdPs that are SAML 2.0 compliant:

  • Okta
  • Oracle Identity Federation
  • Microsoft ADFS
  • Microsoft Azure AD#
  • Google Federation# 
  • Ping Federate
  • Salesforce IdP with externally signed certificate
  • CA Federation
  • ForgeRock OpenAM
  • Shibboleth
  • NetIQ Access Manager
  • OneLogin
  • Novell Access Manager
Opomba:

#If your identity provider is Microsft Azure AD or Google, you can skip the SAML-based method and use the Azure AD Connector or the Google Federation SSO to set up SSO with the Adobe Admin Console respectively. These setups are established and managed using the Adobe Admin Console and use a sync mechanism to manage user identities and entitlements.

Yes, as long as it follows the SAML 2.0 protocol.

Yes and the identity provider must be SAML 2.0 compatible.

At a minimum, your SAML identity provider must have:

  1. IDP Certificate
  2. IDP Login URL
  3. IDP Binding: HTTP-POST or HTTP-Redirect
  4. The Assertion Consumer Service URL of the IDP and it must be able to accept SAML requests and RelayState.

Check with your identity provider if you have further questions.

No, breaking a 2048-bit certificate has never been done. And, the only people to have ever successfully cracked even a 768-bit certificate (the Lenstra group), estimated it would have taken them over 1000 years with the same hardware to crack even a 1024-bitcertificate (a feat roughly 32,000,000 times easier than cracking a 2048-bit certificate).

If you want to get the latest geeky data about estimates for cracking certificates of various lengths, go to this website. For a fun (accurate but marketing-oriented) picture of how secure these certificates are, go to this website (or its backing math website).

No, that limit is on the certificates used to encode the communication pipe between the browser and the server. Whereas these IdP certificates are used to sign (not encode) the data being passed through that encoded pipe. The browser never sees these certificates: they are only used between Adobe and the customer’s IdP.

You can get good, commercial-grade 2048-bit certificates for about $10/year of life. And, the certificates used by IdPs can be self-signed, which means they can be generated with open-source software for free.

No, because there are two other layers of strong encryption which check the IdP’s identity, that you'd have to crack before you could pose as the IdP. And, both of these other layers are not self-signed. Meaning, that you would have to crack not only the certificate that enforces the encryption but the certificate of the signer that generated that certificate.

For your premium support phone number and email address, see the Welcome email and PDF attachment that was sent to your account administrator.

The same URL endpoint may be used for multiple directories. However, the federation metadata will be managed separately for each IdP. So, the common IdP endpoint will need to handle requests whose content is different.

Yes, if the SAML integration of the directory uses username format and the user names on the Admin Console are identical to the persistent IDs provided. However, this would require that the persistent IDs must be available at the time users are sync’d into the Admin Console. This is not a common scenario and hence, in practice, persistent format for the NameID element would not be supported.

No. The NameID element value is used as the username on the Admin Console; the NameQualifier is ignored.

Yes. Adobe supports SHA256 certificates. For details, see Set up identity.

Yes. You will need to give the CA-signed certificates to Adobe customer support and we will upload it for them.

To proceed, sign in to the Admin Console, navigate to Support > Support Summary and click Create Case. For more, see how to create and manage support cases.

By default, Okta certificates are self-signed. By exception (and possibly for a fee) they can have the certificate signed by a public CA instead.

How to

For detailed instructions, see Configure single sign-on to set up SSO with Adobe desktop apps, services, and mobile apps.

No. Sending notifications to end users via the Admin Console is not supported. As an enterprise customer, you need to distribute your own announcements after users are ready to begin with SSO with Adobe software and services.

No, If you remove or disable a user/ID from your enterprise directory, the user/ID is not removed or disabled from the Adobe Admin Console automatically. However, the user is no longer entitled and cannot sign in to the Adobe Creative Cloud desktop apps, services, mobile apps, or Acrobat apps. You need to manually remove the user/ID from the Admin Console.

Yes, you need to use the Adobe Admin Console to manage users, groups, and entitlements. Note, however, that once you create groups in the Admin Console, you can upload a CSV file including both user and group information. This creates the user account and places them in the designated group.

No, you cannot reset passwords for Federated IDs using the Adobe Admin Console. Adobe does not store user credentials. Use your Identity Provider for user management.

Common questions: Directory setup

Find answers to your questions related to directory migration to a new authentication provider and updating a deprecated SAML setup.

Before you start, ensure you meet the access requirements to be able to follow the procedure for migrating to a different identity provider. Also, consider the following points to ensure a seamless and error-free migration for your organization's directories:

  • Admins must create a new SAML app on their IdP setup to configure. If they edit the existing app, it will rewrite any active existing configuration, incur downtime, and nullify the ability to switch between available IdP’s in the Adobe Admin Console.
  • Admins must ensure all required users are assigned to, or can use, the newly-created SAML app.
  • Admins must ensure the username format for the new authentication profile in their IdP matches what is used by the existing profile for user login. They can use the Test feature provided on the authentication profile to verify. This Test link can be copied to clipboard and share it with others to validate from their machines.
  • Admins should test the newly-added IdP prior to activation with 2 to 3 active accounts of the directory.

Error logs will not be available for these features. However, the Test workflow allows the Admin to validate relevant errors prior to activation. Limitations to consider include: 

  • One directory can have up to two authentication profiles, and both the profiles should be for different authentication types. This means Microsoft Azure AD (which uses Open ID Connect) can stay with Other SAML providers, but Google (which itself uses SAML) cannot stay with Other SAML providers in the same directory. 
  • This feature does not allow admins to migrate their identity provider to enable directory sync functionality (Azure AD Connector and Google Connector). Although customers migrating to Microsoft Azure or Google as their IdP can utilize a different form of user management strategy. To learn more, see Adobe Admin Console users.

 Adobe

Pridobite pomoč hitreje in preprosteje

Ali ste nov uporabnik?

Adobe MAX 2024

Adobe MAX
Konferenca o ustvarjalnosti

14.–16. oktober v Miami Beachu in spletu

Adobe MAX

Konferenca o ustvarjalnosti

14.–16. oktober v Miami Beachu in spletu

Adobe MAX 2024

Adobe MAX
Konferenca o ustvarjalnosti

14.–16. oktober v Miami Beachu in spletu

Adobe MAX

Konferenca o ustvarjalnosti

14.–16. oktober v Miami Beachu in spletu