Found another error that we see a lot that I wanted to put check out
there for you to know: The error "another user is currently logged in"
occurs when the attributes sent in the SAML assertion do not match the
email address that was used to start the login process.Check the
attributes in the SAML assertion and make sure that they are an exact
match to the ID the user is attempting to use, and also an exact match
with the Admin Console. - How to perform a SAML Trace Chances are the
Email address...
I have seen recently an increase of these kind of cases coming into our
support teams. Thought I would address a good way to trouble shoot
them:If you have a user getting "Access Denied" Here is some possible
ways to address this:Possible causes for this error:The first name, last
name, or email address being sent in the SAML assertion does not match
the information entered in the Admin Console.The user isn't associated
to the right product, or the product is not associated with the correct
enti...
Let's talk about Brand Portal setups. I have seen an increase on the
usage of Brand Portal. Which is Awesome! When you setup your Single Sign
on for the Cloud this is for all products. One of the things that I
would like you to factor in is if you intend to use Brand Portal. Brand
Portal requires that you use the binding of RE-DIRECT rather than using
HTTP-POST. If it is configured without using RE-DIRECT chances are your
Brand Portal will not work. Simple configuration adjustment in the Admin
C...
For those of you have wondered what happens when a Cloud gets untrusted?
Let me answer that for you. If you have a domain that is trusted to the
other Cloud and for some reason someone decides to untrust that Cloud.
The Cloud that is trusted domain access gets revoked. But what is worse
is that users that are associated with that domain are removed. So it is
very important that you do not untrust a domain from another Cloud
unless both parties have agreed on this. Because this will cause some
se...
We understand the need to want to improve your current setups in the
Admin Console. Sometimes that is because of new mandates that require
you to get off of using Adobe IDs and move to Federated Ids or
Enterprise Ids. In the forums I have covered the how do I create an
Single Sign On setup. But how do you convert the users that are already
in the Cloud? If you have users that are in the Cloud already and you
need them moved for now the answer is to reach out to Client Care
support teams. We can ...
Recently Adobe released this new feature where you can upgrade to using
a SHA-256 configuration in the Admin console.First question that I
always get asked: How can I tell if don't already have a SHA-256 setup?
Great questions! As of November 14th 2019 any directories created at
this point in the Admin console would automatically be SHA-256. So
chances are if you are looking to renew your cert, or want to move the
this new setup that you are going to want to do one of two options. For
those of y...
I have recently seen many of our clients trying to configuration Azure
with the Admin console. So I wanted to a few minutes and share some tips
that might make this process a little bit more clearer on your setup.
Here is the documentation for this configuration:Configure Microsoft
Azure for use with Adobe SSOSetup on the document is really straight
forward. The part though that I am seeing some of the struggle with is
how do I create the User groups and make that equal User permissions?As
we kn...
I recently had the pleasure of speaking to a client about how to setup
our Single Sign On configuration. And the commit was mentioned to me
that our documentation on how to configure our Single Sign on setups is
hard to find. So I wanted to see if I could make that easier for some of
you looking to do Single Sign on for your Clouds. Here is the current
list of current setups that we have and their links to how to do
them:Enabling Single Sign-On with SAML - Adobe SignConfigure Microsoft
AD FS for...
Good afternoon! Noticing a few requests seem to be coming in recently
regarding User permissions and understanding the roles in the Admin
console so I wanted to direct your attention to this document as it
explains the roles quite well:Administrative roles Here is a break down
of what each permission in the Admin console actually gets. Seems lately
there has been come confusion about that that I have seen so I wanted to
share with you this nifty chart to better explain how it works.Hope this
hel...
One of the more common issues that our teams see with Single Sign on
that results in an a panic is the following error found in the Single
Sign on Events tab in the Directory setup within the Admin console.
Error "The current time is before the time-range specified in the
assertion conditions" This will be in the events when you look at more
details located on the right side of the user login attempts. If you see
this simple means that the clocks are different between your IdP usually
ADFS and A...
Are you currently working on an Single Sign On integration? Or trying to
troubleshoot a Single Sign on setup? SAML traces are quite useful for
this process.Here is the instruction on how to do a SAML trace:How to
perform a SAML Trace In your Settings in the Admin console
(adminconsole.adobe.com) go to Identity and to the Directory and look to
see what the User login setting is set to.If it is set to Email that
means in the SAML you should see: FirstName, LastName, Email as what we
are looking to...
Great news for you out there!For those of you looking to implement
Single Sign On. We have recently updated our Single Sign on so natively
out of the setup your directly will be setup as a SHA-256 setup so you
can do the setup directly from the Admin console rather than reaching
out to Client Care teams.We will have a migration option for you coming
soon! For upgrades for Single Sign on please reach out to Client care
teams to be assisted for current integration setups that need Cert
renewals.If...
Jinyu,Thank you for alerting us to that problem if you are seeing that
means we probably need to look at integration on the Report suite that
is having this problem. May just need to have the integration request
run on it and that should fix that error. It sounds like Its missing a
piece. Please when you get a second if this is still a problem reach out
to us here so we may assist you.Best,Kerry Nelson
We heard you loud and clear on the last login time stamping. Please
continue to vote this up. In the meantime please have your CSM reach out
to me on serious request for a need for this. There may be solutions we
can offer. Thanks!Kerry Nelson
If The domain is claimed which matches your SSO then you will be first
presented with the option to create the user as Federated ID and then
there will be a secondary link below to do Adobe ID.SSO does not mean
user permissions so if users need access Analytics through SSO you can
setup the users for SSO and then create what we call “User groups” and
then create a user group of those users which would give them access to
Analytics. If that is there only product then that would automatically
drop...
Some of you may have noticed a new bar showing up in the Cloud when you
logged in this week. Wanted to open up a spot on the forums to discuss
this:Below is an article that explains why this is now showing up:As
stated in the document:Why you must add security contacts With Adobe's
emphasis on protecting your organization's and users' data, in the event
of a security incident involving our software solutions, notifications
are sent to the appropriate compliance officers.Enterprises have their
ow...
So to get that integration setup you first have to get the integration
setup on your cloud for what we call People Core Services. So I would
start with opening a request to your CSM or opening a ticket to
clientcare@adobe.com requesting People Core services to be enabled on
your cloud. That will take a little bit to get setup. And then once that
is done the integration on AEM to AAM requires that you do the setup
under the Step in the Cloud services section on AEM to connect AEM to
the accounts ...
What I meant by that is its easier to manage the integrations and know
what integrations are present when you set that up in the Adobe I/O
because what that's going to do is flag it as an integration with the
Admin Console under "Integrations" Adobe I/O creates a technical user
account for the integration when you set up an integration. That's what
I said its easier to set it up that way through Adobe I/O.APIs
What can you do with them? Very cool stuff actually! Thanks for asking
the question! Audience Manager is built to allow you to take advantage
of segment information. Meaning you can create a segment to learn
information about your client about your client base. Like color of
dress, favorite sports team or a specific age group. Combining this into
AEM makes more of a dynamic experience for your clients.That is what you
can do with these two combined with other tools you can do other very
cool thi...
Olivier,Good morning! Glad to hear that the SSO part appears to be
working for you. The way that SSO is setup it does not sync users from
the IDP side to the Cloud you are correct it does have to relay on UMAPI
service for that otherwise in some cases you can use the Azure Connector
if that is what your backend Active Directory looks like.Here is the
documentation that I have on this: User Sync Tool by Adobe Should be a
link within that document that will take you to UMAPI tools and then
walk yo...
Tom,Good morning! Yes, I have seen this happen with Experience Cloud
side. Clearing the cache and cookies is great for some things. If that
though is not working then its best to go a little deeper when you clear
the cache and cookies and that is to remove all the cookies coming from
Adobe.com. So I would only use this as a last resort if clearing the
cache and cookies the standard way is not fixing the issue.Best,Kerry
Harshit,Good morning! Mostly what that one comes down to is its easier
to manage the connection in Adobe I/O. Yes in theory you could do that
without it but simply we found that it works better when you do that
with Adobe I/O its just easier to work with.Best,Kerry
So this is what I would do if this was my project and sites. First of
all since you have access to Analytics create a Stage report suite and
toss a page from staging on it and firstly enable Visitor ID service and
go through that parts for doing the tracking. This way we don't mess
with anything currently you have setup. And then gradually change this
over. Anytime something is hard coded this should be changed over to
Launch as a rule so it can be managed with in Launch. The idea is we
break yo...
Good afternoon,I noticed your question was still not answered. It
shouldn't need any new ports opened by you or your teams to use the
product. Are you experiencing any kind of block at present?Kerry
Was the user removed from Analytics is that what this scenario is? You
can disable the user by simply setting the range on the user account for
the date that they are able to login from to the previous days time. So
what that would do is not allow the user to get into the account at all
from the Cloud that would be one way. And then you should be still able
to use the segments created by that user for sure. Will that work? Or is
there something further you are looking to do?
