Hello everyone, I’ll try to explain what I’m attempting to do, as I’m not sure if it’s possible, and if it is, how it should be done or what the best approach would be. Environment: VM1: Netwrix PAM Server ( pam.domain.com changed from default https://localhost:6500 ) VM2: RAG Gateway VM3: RAG Por…

Hello Mikas, Netwrix Documentation This is the documentation on how to set up the Azure App for OIDC connections. I will review what you have here and get back to you. I just wanted to send you this right away in case you haven’t seen it.

Hi Mikas! [image] Mikas: PS: I had to change the example domain names to URL1 and URL2 because it turns out new users can only post 2 URLs :slight_smile: Sorry about that! You should be able to use more links now—I just tweaked this setting :slight_smile:

Thanks, i edited original post :slight_smile:

Hello Mikas, Thanks for reaching out. There is a current limitation with SAML and using the RAG Portal. You do need to set up two separate Authentication connectors, one for internal use and another for external use. We wanted to make sure that there was a clear separation. Since you are using an …

[image] Kevin Horvatin: l allow you to use the sam Thank you for the information, I will try to reconfigure it tomorrow. Could you please clarify further? In the Entra Enterprise application, I am using https://portal.domain.com/samlSigninCallback as the Reply URL. It seems to have a differe…

/samlSigninCallback is for SAML authentication flow. /callback is for OIDC authentication flow.

Please also be aware that NPS will allow you to select a single ‘Authenticator connecter’ per user on the ‘authentication connector’ tab on the user details. So please ensure that your regular users have the appropriate authentication connector assigned to them (i.e. Entra ID OIDC - Portal) vs your…

Thank you for the clarification. In that case, the documentation is inaccurate: Netwrix Documentation .

Thank you for bringing this to my attention. I will make sure to get this updated!

Hi, @kevin.horvatin Im stuck on configuring OpenID, I had an MS Teams meeting with Netwrix support, but they couldn’t help either. Maybe you can point me in the right direction. Steps I take: Microsoft Azure → App registrations → New Registration Accounts in this organizational directory only (D…

Silly question but did you click on the ‘Consent on behalf of your organization’ box? <a class="lightbox" href="https://netwrix1.discourse-cdn.com/netwrix/original/1X/dde0f526a48b28c0aea2b2eabe7bc2e6e8a2fed3.png" data-download-href="/uploads/short-url/vEPuphLTxqXSOQpslhnSYdxpyQb.png?dl=1" title="The image shows a permissions request dialog from Microsoft for an application called "SbPAM OIDC," indicating that it is not published by Microsoft and includes an option to consent on behalf of an organization. (Captioned by AI)" rel="noopener nofollow ugc">[The image shows a permissions request dialog from Microsoft for an application called "SbPAM OIDC," indicating that it is not published by Microsoft and includes an option to consent on behalf of an organization…

SAML configuration with RAG Portal

Products Privilege Secure Discussions & Questions

derek.putnam (Derek Putnam) March 10, 2025, 4:39pm 2

Hi Mikas!

Sorry about that! You should be able to use more links now—I just tweaked this setting

Topic		Replies	Views
Grouping of RAG services Discussions & Questions privilege-secure , question	3	109	July 4, 2025
Retrieving a SAML SSO Token Show & Tell privilege-secure , api	3	129	May 12, 2025
Add support f0r EntraID (guest) users and groups to use as NPS user Ideas under-review , ideas , entra-id	2	27	February 20, 2026
Netwrix Reverse Access Gateway Discussions & Questions privilege-secure , discussion	6	121	December 22, 2025
Privilege secure RDP access with domain users without password Discussions & Questions rpd , ms-entra	3	146	May 2, 2025

SAML configuration with RAG Portal

Related topics