Adobe Creative Cloud for education | Deployment Guide

Sign in to the Admin Console, navigate to Settings > Identity, and click Create Directory.

Enter a name for the directory and choose an identity type.

Choose Enterprise ID and click Create Directory, or choose Federated ID and click Next.

(Federated ID only)

On Who is your identity provider screen, do one of the following:

• Select Microsoft Azure Active Directory, click Next, and proceed with creating a directory as described in Set up Azure AD Connector.
  
• Select Google, click Next, and proceed with creating a directory as described in Set up Google federation.
• Select Other SAML Providers, click Create, and Configure Single-Sign On.

To use Federated ID authentication, you must have a SAML2-compatible Identity Provider.

In the Admin Console, navigate to Users > Users, and click Add User.

Enter the email address of the user. The recommended ID Type is populated automatically.

Enter the First Name and Last Name of the user.

For an Enterprise ID, select the Country of the user. For a Federated ID, enter an SSO Username and select the Country of the user.

Select the products or user groups to assign to the user. The list of products that displays, is based on the purchase plan of your organization.

Learn more on how to manage products and product profiles.

Once you've successfully created the user and assigned a product, you receive an email on the associated email account. Follow the instructions in the email.

In the Admin Console, navigate to Products.

A list is displayed of all Adobe product plans for which you are an administrator.

Select the desired product plan, and click New Profile.

The Create a New Profile wizard displays.

Enter a profile name, display name, and description.

To automatically notify users by email when they are added or removed from this profile, enable the Notification toggle, and click Next.

On the Services screen, you can choose to enable or disable individual services for the product profile.

Click Save to save the new profile.

In the Admin Console, navigate to Users > User Groups, and click New User Group.

Enter a name and description for the user group and click Save.

The description does not play any role in the setup and is for information purposes only.

Also, you can add an admin specific to a user group, called the User Group Administrator. To do so, click the group name. Navigate to Admins, and click Add Admin.

Enter the email address for the admin. You can search for existing users or add new users by specifying a valid email address and filling in the information on the screen.

Then, click Save.

To manage the entitlements given to users, assign product profiles to the user group. Click the group name, navigate to Assigned Product Profiles, and click Assign Product Profile.

Add the desired Product Profiles to the user group, and click Save.

In the Admin Console, navigate to Users and click Add Users by CSV.

In the Add Users by CSV dialog box, click Download CSV Template, and choose Standard template.

Open the downloaded CSV template in a spreadsheet editor like Microsoft Excel, and paste your users into the template like the screenshot below.

For a description of the fields in the downloaded file, see CSV File format.

For Enterprise IDs and Federated IDs, columns A to G are mandatory. 

If you are using user groups to manage access to products, assign users to the appropriate groups using columns K and L. In this case, you can leave the other cells empty.

Drag the updated CSV on to the Add Users by CSV dialog box and click Upload.

For more information on bulk operations, see Manage Users and Bulk Operations.

Install SAML trace add-on in the user's browser.

Ensure that the user is signed out of Adobe account.

Locate and click the SAML Trace window from the SAML icon in the toolbar.

A separate window displays. Move it out of the way and leave it open.

Navigate to www.adobe.com, and click Sign In and proceed as far as possible through login.

When the issue occurs, navigate to the SAML trace window as shown in the screenshot below.

Locate and click the POST line in Orange with SAML tag that ends in ‘accauthlinktest’.

Click SAML (next to HTML and Parameters).

Copy all contents to text file and include with new support case.

To perform SSO triage, locate the 4 mandatory SAML 2.0 assertions:

1. NameID
2. FirstName
3. LastName
4. Email

• Case must exactly match that shown in the list above.
• Check the values next to each and validate that each is populated.
• Check to be sure that Email matches NameID.
• Check to be sure that Email and NameID formats are both correct and complete.

A mismatch between the network user account and the Adobe user account name causes SSO to fail.

When problems arise, another good place to check is the Admin Console under Settings > Identity > <click domain> > Event Logs. These logs are provided from the SP (Okta) syslog. It can take a few minutes for the log to update.