Logging in through SAML FAQs

This will answer the frequently asked questions in regards with logging in through SAML.

Q. Will enabling SAML feature in our production account prevent other users from logging in to the system?

A. No, turning on SAML for your production account will not affect other UI users from logging in. They will still be able to login using their username and password like they always have. Same applies to non-production accounts.

 

Q. Does NetSuite work in SSO-only mode? If I turn on SAML SSO, will my users still be able to login using their username and password?

A. The answer is the same with the one for the previous question. In addition, NetSuite does not have a system-wide preference for SSO-only mode. However, there's a role preference that works that way but this does not apply to SAML authentication mechanism. See solution ID: 19228 for more details.

 

Q. If I give a SAML role to an employee, can he still login using his username and password?

A. Yes. As long as you don't remove all the UI roles that this person has (the roles they see after logging in with their username and password), adding a SAML role to a user will not affect how he's logging in just like before.

 

Q. Can I both use NetSuite's token-based Inbound SSO and SAML SSO for logging in to NetSuite?

A. Yes. There will be differences between the two though. One is that, when you login through SAML, you will only be able to see your SAML role when you try to switch roles. And when you login through Inbound SSO, you will not be able to see your SAML role when you try to switch roles. See solution ID: 29354 for more details.

 

Q. A user can't login to NetSuite with his username and password after enabling SAML. What happened?

A. This happens if you customize the only role that this user has wherein you added the 'SAML Single Sign-on' permission for that role. To solve this, you must remove this permission to that role. Then assign another role with 'SAML Single Sign-on' permission.