New installation

Complete the standard installation of BigFix Inventory 11.0.8 and create the initial system administrator account. This user is responsible for defining the initial functional rules for SSO groups.

1. IDP Configuration for groups/claims
   1. IDP administrator need to create IDP groups for BigFix Inventory related permissions
   2. IDP administrator need to add users to respective BigFix Inventory groups
2. BFI Configuration for SSO
   1. Navigate to Administration > Users and Roles > Single Sign-On Settings.
   2. Enter your provider's web link and upload your security certificates.
      Note: Enabling SSO will disable LDAP-based logins.

In the Advanced Server Settings, ensure the following parameters are set:

Enable SSO user provisioning: This feature is disabled by default and must be manually enabled by an administrator. To enable, set the parameter platform_user_provisioning_sso_any_enabled to 'true'.

SSO Admin user must map IdP group names to BFI roles and computer groups before auto-provisioning can function.

1. Navigate to the Administration > Users and Roles > User Provisioning dashboard.
2. Create a new rule by entering the exact SAML Group Name from your IdP.
3. Assign the corresponding BFI Roles and BFI Computer Groups.
4. Set a Priority (1-100) for the rule to handle users belonging to multiple groups.
   Note: Lower the number, Higher the priority

When a user belongs to multiple IdP groups, more than one provisioning rule may be applicable. In such cases, the system evaluates all matching provisioning rules and assigns permissions based on the rule with the highest priority.

This ensures that users receive a single, consistent set of permissions, even when multiple group memberships match different provisioning rules. If your assigned permissions do not match your expected access level, contact your administrator.