What parameters are required from Identity Provider (IdP) that should be configured in inSync Management Console?

Currently, inSync supports the following parameters from an IdP:

• ID Provider Login URL
• ID Provider Certificate

Which RelayState parameters are required for configuring SSO for users and administrators?

RelayState is a parameter used by SAML protocol implementation to identify the specific resource as the resource provider in an IdP initiated single sign-on scenario.

What parameters are required from service providers that should be configured with IdP?

In this case, inSync is the service provider and other party is the IdP. The parameters that are required by the IdP are as follows:

• RelayState or Entity ID
• Claim Rules
• EndPoint URL
• inSync_auth_token

What are the Default Claim Rules that are required to be configured at IdP?

Does inSync support two-factor authentication in case of SSO? 

Yes. inSync supports two-factor authentication. First authentication is done when the request is redirected from Service Provider to IdP.

• Second authentication takes place with the use of “inSync_auth_token” parameter generated from the inSync Management Console. To generate SSO token,inSync Management Console. To generate SSO token,
  1. Navigate to Manage > Settings > Single Sign-On and then click Generate SSO Token.
  2. Copy the token and enter it in IdP console.

Note: Druva recommends that you generate the SSO token only once. If you generate the SSO token again, the old SSO token (that you shared with your IdP) becomes inactive. You must  then again share the newly generated SSO token with your IdP.

Does inSync support Metadata file and Logout URL?

No. Currently, inSync does not support metadata file provided by an IdP and logout URL. Contact Druva Support for more details.

What is the Endpoint URL for inSync SSO?

Endpoint URL for Existing inSync customers who already have configured Single Sign-on is: https://cloud.druva.com/wrsaml/consume.

Endpoint URL for Existing inSync customers who have not configured Single Sign-on until July 14th, 2018 is: https://login.druva.com/api/commonlogin/samlconsume.

Endpoint URL for New inSync customers (on-boarded after July 14th, 2018) is: https://login.druva.com/api/commonlogin/samlconsume.

Endpoint URL for New inSync GovCloud customers (on-boarded after July 20th, 2019) is: https://loginfederal.druva.com/api/commonlogin/samlconsume.

Can an administrator except Druva Cloud Administrator configure SSO for administrators?

No. Only a Druva Cloud Administrator has permissions to configure SSO for administrators.

Which certificate is required from ADFS that needs to be configured with inSync?

inSync requires Token Signing Certificate or ID Provider Certificate from ADFS. It must be configured in inSync Management Console.

To obtain ID Provider Certificate,

1. On the ADFS 2.0 console, click Service > Certificates.
2. In the Certificates window, select the token signing certificate placed under Token-signing category.
   Certificate properties windows appear.
3. Click on the Details tab and then click Copy to File.
   Certificate Export Wizard appears. Click Next
4. Select Base-64 encoded X.509 (.CER) and click Next. The ID Provider Certificate is exported.

How to resolve Invalid Password error seen when trying to activate the inSync Client or while logging on to user's Web Console but when the old password still works?

inSync uses inSync password as a fallback mechanism if the IdP redirection is failing. There can be various reasons for this fallback such as invalid IdP URL or IdP certificate. If you run into this problem, please contact Support.