Sign in with SAML

When you finish, people sign in to the cluster through your SAML 2.0 identity provider. Password sign-in keeps working until you decide to require SSO.

Before you start

• A Qumulo cluster with a DNS name, whose REST API on port 8000 you can reach from this machine
• A local admin account such as admin for the connection profile, not an Active Directory account
• A SAML 2.0 identity provider, with its SSO URL, its entity ID, and its X.509 certificate in PEM format
• Terraform 1.11 or later

1. Copy the configuration

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_saml_settings" "main" {
  connection_profile = "cluster1"

  enabled          = true
  idp_sso_url      = "https://idp.example.com/sso"    # <-- Replace with your identity provider's SSO URL
  idp_entity_id    = "https://idp.example.com/entity" # <-- Replace with your identity provider's entity ID
  cluster_dns_name = "cluster.example.com"            # <-- Replace with your cluster's DNS name
  require_sso      = false

  # <-- Replace with your identity provider's PEM certificate
  idp_certificate = <<-EOT
    -----BEGIN CERTIFICATE-----
    MIIDdzCCAl+gAwIBAgIJAExampleCertificateReplaceMe
    -----END CERTIFICATE-----
  EOT
}

Replace the six values marked <-- Replace, and leave the rest as written. For the certificate, paste your PEM file's contents between the <<-EOT and EOT lines in place of the placeholder.

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Apply

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

3. Register the cluster with your identity provider

In your identity provider, create a SAML application for the cluster with these two values, using the cluster_dns_name you set.

• Service provider entity ID: https://<cluster_dns_name>:8000/saml/metadata
• Assertion consumer service URL: https://<cluster_dns_name>:8000/saml/consume

The identity provider now lists the cluster as an application it can sign people in to.

4. Test SSO

Sign in to the cluster's web UI through your identity provider. Password sign-in still works alongside it, since require_sso is false.

5. Require SSO for Active Directory users

If your policy calls for SSO only, set require_sso = true and run terraform apply. Active Directory users then sign in only through SSO on the web UI, the qq CLI, and the REST API, while local users such as admin keep password sign-in.

Warning

Confirm the connection profile signs in as a local user such as admin before you set require_sso = true. A profile that signs in as an Active Directory user loses password access, and Terraform is locked out of the cluster.

The plan shows require_sso changing from false to true. The apply ends with Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Next

SSO behavior is covered in Qumulo's SAML documentation, and removing the qumulo_saml_settings block later turns SAML off on the cluster. The qumulo_saml_settings reference describes every attribute, Manage several clusters from one configuration rolls these settings across a fleet, and the cluster troubleshooting guide helps if a step fails.