Comprehensive data protection for all workloads
Post Reply
JonJR
Influencer
Posts: 21
Liked: 6 times
Joined: Mar 21, 2017 11:25 pm
Full Name: Jon Rhoades
Contact:

Enterprise Manager SAML - FQDN issue

Post by JonJR »

Just setup SAML (using a Duo DAG) for Veeam Enterprise manager. When it was installed Veeam EM has decided that it's URL is the "domainless" version eg https://veeam-em:9433 rather than https://veeam-em.company.com:9443. This has no effect on normal use of the EM website, except when logging on using SAML as it is a lot more sensitive to this.

The login flow is:
https://veeam-em.company.com:9443 - enter the email/upn of the remote account
Get forwarded to the SAML SSO page
https://duodag.company.com - enter username and password
Get redirect back to Veeam EM
https://veeam-em:9443
Veeam EM doesn't log you in as it wasn't expecting the incoming SAML request.

Logging in using https://veeam-em:9443 works fine.

I didn't have the domain suffix set for it's NIC when I installed Veeam EM, which may have given the result I'm after. But can you change the name of Veeam EM without installing?

HannesK
Veeam Software
Posts: 5739
Liked: 791 times
Joined: Sep 01, 2014 11:46 am
Location: Austria
Contact:

Re: Enterprise Manager SAML - FQDN issue

Post by HannesK »

Hello,
When it was installed Veeam EM has decided that it's URL is the "domainless"
hmm, where did you do that? I just manually clicked through the installation wizard and had no chance to do it.

Just to clarify... you don't have the domain name in settings -> SAML authentication -> Enterprise manager configuration (screenshot below)?
Image

Best regards,
Hannes

JonJR
Influencer
Posts: 21
Liked: 6 times
Joined: Mar 21, 2017 11:25 pm
Full Name: Jon Rhoades
Contact:

Re: Enterprise Manager SAML - FQDN issue

Post by JonJR »

Hi Hannes,

Thanks for you reply.
hmm, where did you do that? I just manually clicked through the installation wizard and had no chance to do it.
Sorry I just meant I didn't get choose what the name was - I had the same experience as you

Image

As you can see it's got the non FQDN path.

HannesK
Veeam Software
Posts: 5739
Liked: 791 times
Joined: Sep 01, 2014 11:46 am
Location: Austria
Contact:

Re: Enterprise Manager SAML - FQDN issue

Post by HannesK »

ah sorry, I did not read properly...

as you mention that you did not set the DNS suffix... does that mean that your enterprise manager machine is not joined to a Windows active directory domain?

JonJR
Influencer
Posts: 21
Liked: 6 times
Joined: Mar 21, 2017 11:25 pm
Full Name: Jon Rhoades
Contact:

Re: Enterprise Manager SAML - FQDN issue

Post by JonJR »

as you mention that you did not set the DNS suffix... does that mean that your enterprise manager machine is not joined to a Windows active directory domain?
The machine isn't domain joined, but actually the DNS suffix is set on its NIC - either Puppet or Foreman does that for us.

HannesK
Veeam Software
Posts: 5739
Liked: 791 times
Joined: Sep 01, 2014 11:46 am
Location: Austria
Contact:

Re: Enterprise Manager SAML - FQDN issue

Post by HannesK » 1 person likes this post

Hello,
ok, I reproduced it without domain and even with configured DNS suffix I have the same result like you. So re-installing will not help.

But there is a configuration option for that... C:\Program Files\Veeam\Backup and Replication\Enterprise Manager\WebApp\Web.config

In block <appSettings> you can add key:

Code: Select all

	<add key="applicationUrl" value="https://hk-em-no-domain.lab.intern:9443" />
The value must be the fqdn

Best regards,
Hannes

vipthomps
Service Provider
Posts: 52
Liked: 5 times
Joined: Dec 06, 2010 7:51 pm
Full Name: Eric Thompson
Location: Boston, MA
Contact:

Re: Enterprise Manager SAML - FQDN issue

Post by vipthomps »

I just wanted to add that this fixed our SAML issue when authenticating externally without being able to resolve and access the internal name of the server

Post Reply

Who is online

Users browsing this forum: allynz, amarsaudon, Baidu [Spider], Bing [Bot] and 32 guests