Add Identity Providers and Users

• Set up the user accounts and roles for the users who will use this intregation to authenticate to Juniper Mist portal.

• Create a SAML 2.0 SSO integration for Juniper Mist.

  Note:

  If your IdP requires metadata from Juniper Mist, see Obtain Juniper Mist Metadata for SAML 2.0 Integration.

• Get the following information from the SAML 2.0 SSO integration:

  • Signing Algorithm

  • Issuer

  • SSO URL

• Download the certificate.

• Signing Algorithm—Select the same signing algorithm that you selected in your IdP SAML 2.0 integration.

• Issuer

• SSO URL

• Certificate—Open the certificate that you downloaded. Copy the entire text and paste it into this field. Include the BEGIN CERTIFICATE and END CERTIFICATE lines.

Example:

This example shows how you would complete the Juniper Mist fields on the left by entering the values from the Microsoft Azure fields on the right.

• Create custom roles. Create custom roles corresponding to the IdP roles for your users who will access Juniper Mist through SSO. The user role determines which portal features the user can access. For help with custom roles, see Create Custom Roles for Single Sign-On Access.

• Delete local accounts.Delete any previously created admin accounts for your Mist organization, except one Super User account.

  Here's why:

  Since you want to use your IdP instead of Mist to authenticate users, their previously created Mist accounts serve no purpose. When someone uses SSO to login, that email address is "linked" to the SSO IdP, and their previously created local account cannot be used unless the SSO configuration is deleted.

  We recommend having one local account with the Super User role as an emergency backup. This way, in case SSO issues occur, one person is able to use their local account to access your Mist organization.

  Since a person cannot use one email address for both SSO and a local account, the local account should be set up with a different email address than the one they'll use with SSO. For example, use a personal email address for the local account and use the work email address for the SSO account.

  • As a Super User, you can remove account. See Revoke a User's Access.

  • As an admin, anyone can change the email address that they use for their Mist account. See Account Settings.

• Provide first-time login instructions. Ensure that your users understand the first-time login process. When they first log in to Juniper Mist, they must connect to Juniper Mist by using the SSO URL or their IdP dashboard. This step is necessary for the first login only, to establish the account as an SSO account. After that, they can use the SSO URL or go to directly to the Juniper Mist portal (manage.mist.com).