Prerequisites for SAML v2.0 and OAuth2 SSO configuration

Last Updated : Jun 10, 2026 |

SAML v2.0

Before configuring SSO authentication on Avaya Aura® Device Services, gather the following information and configure an SSO application on the identity provider that you are planning to use:

  • In a cluster deployment, if Avaya Aura® Device Services nodes are located in multiple data centers, ensure that port 7600 is open in the data centers for subnets where cluster nodes are deployed.

  • Determine the attribute names that the identity provider sends in SAML responses for the following:

    • First name

    • Last name

    • Email address

    • Group/Role indicator

  • Configure the NameID format. Avaya Aura® Device Services uses the emailAddress format for NameID.

  • Ensure that the identity provider supports the Service Provider-initiated (SP-initiated) flow and the SP-initiated flow is enabled and configured on the identity provider.

  • Configure an SSO application on the third-party identity provider’s side.

  • Obtain the SAML v2.0 identity provider’s IDPSSODescriptor metadata file.

    You can obtain this file from the third-party identity provider.

    You must import this metadata file into Keycloak when enabling SSO authentication support on Avaya Aura® Device Services or after Avaya Aura® Device Services is installed.

  • Obtain the SPSSODescriptor metadata file.

    You can obtain this file from the following URL after the identity provider is added to Keycloak:

    https://<AADS FQDN>:<AADS PORT>/auth/realms/SolutionRealm/broker/<SAML V2 PROVIDER NAME>/endpoint/descriptor

    For example, if the Avaya Aura® Device Services front-end FQDN is aads.company.com, the AADS front-end port is the default port 443, and you created on SAML v2.0 identity provider on Keycloak with the name mySAMLProvider, then the URL for retrieving the SPSSODescriptor file is:

    https://aads.company.com/auth/realms/SolutionRealm/broker/mySAMLProvider/endpoint/descriptor

    You can also obtain this file from the Keycloak administration portal.

    Important:

    If you download the SPSSODescriptor metadata file from the Keycloak administration portal, you must replace port 8445 with the Avaya Aura® Device Services front-end port in the following entries in the metadata file:

    • <AADS_FQDN>:8445/auth/realms/SolutionRealm
    • <AADS_FQDN>:8445/auth/realms/SolutionRealm/broker/<IDP_ALIAS>/endpoint

    In these entries, AADS_FQDN is the Avaya Aura® Device Services FQDN and IDP_ALIAS is the identity provider alias.

    The default front-end port is 443.

OAuth2

Currently, Avaya Aura® Device Services only supports the Office 365 OAuth2 identity provider.

  • Determine the attribute names that the identity provider sends in OAuth2 token responses for the following:

    • First Name

    • Last Name

    • Email Address

    • Client ID

    • Client Secret

  • Add and configure an application for SSO purposes on the Microsoft Azure portal.