Entra ID SAML2 SSO on FlashArray (Purity//FA 6.12.3), including fleets
Hi everyone, Here is a working setup for single sign-on from Microsoft Entra ID to a FlashArray, tested on Purity//FA 6.12.3, which is the newest version at the time of writing. It follows the Microsoft tutorial for Pure Storage SSO (https://learn.microsoft.com/en-us/entra/identity/saas-apps/pure-storage-sso-tutorial) and adds the fixes I needed to get the login test to pass. It also covers adding more arrays and fleets. Two things that break the login if you skip them The gallery app ships with role names that do not match the FlashArray role names. If you do not rename them, the login test fails because the array cannot find the role (Step 6). The claims must have no namespace URI (Step 5). What you need An array admin login Entra admin rights (Enterprise applications and App registrations) The Pure Storage SSO app from the Entra App Gallery A user or group to assign Overview Create a certificate on the array Configure SAML2 SSO on the array Entra app and the array certificate Load the Entra signing certificate on the array Claims (delete the namespace URI) Fix the app role names Assign, test and enable Plus: more arrays and fleets, and a troubleshooting list at the end. Step 1: Create a certificate on the array The array needs its own RSA certificate to sign SAML requests and decrypt assertions. Do not use the management certificate: it is EC 256 and caused a 500 error for me. purecert self-signed create saml-sp --common-name myarray.pure --days 365 purecert list The saml-sp row should show self-signed, rsa, 2048. Note the expiry date: SSO signing stops working when it expires. Step 2: Configure SAML2 SSO on the array Go to Settings › Access › Users and Policies › SAML2 SSO and edit the configuration. Array URL: the array FQDN, for example https://myarray.pure/. Signing Credential and Decryption Credential: type the certificate name saml-sp. Do not paste certificate text. Switch on Sign Request and Encrypt Assertion. IdP Entity ID, URL and IdP Metadata URL: copy them from the Entra app (Set up Pure Storage SSO section). Keep Enabled off for now and save. Without credentials, saving fails with "Must provide signing credential when signed request is enabled" and the same message for decryption. The GUI can silently keep management, so check the result in the CLI: puresso saml2 list puresso saml2 test Both credential columns must show saml-sp. If not, set them directly: puresso saml2 setattr Entra-ID --signing-credential saml-sp --decryption-credential saml-sp This can print "Certificate claim does not exist." even though the values were applied, so trust the list output. Step 3: Entra app and the array certificate In the Entra admin center go to Enterprise apps › New application, search Pure Storage SSO and add it. Open Single sign-on › SAML › Basic SAML Configuration. Set Identifier to the array's SP Entity ID and Reply URL to the array's Assertion Consumer URL. Both are shown in the array's SAML2 SSO dialog, so copy them from there. On the array, open the certificates page and download saml-sp. Rename the extension from .crt to .cer. In the Entra app go to Single sign-on › SAML Certificates › Verification certificates › Edit, tick Require verification certificates, and upload the .cer. Because Encrypt Assertion is on, also import the same .cer under Token encryption and activate it (see the token encryption guide under Links). Check that you exported the right certificate: openssl x509 -in saml-sp.cer -noout -subject -enddate The subject must show the common name you used in Step 1, not the GUI certificate. Step 4: Load the Entra signing certificate on the array The array needs Entra's signing certificate to validate the response. If this is empty the array test still shows OK, but a real login fails. In Entra open Single sign-on › SAML Certificates and download Certificate (Base64). Open the file, copy everything including the BEGIN CERTIFICATE and END CERTIFICATE lines. In the array's SAML2 SSO dialog click Edit next to Verification Certificate and paste it. CLI alternative: puresso saml2 setattr Entra-ID --verification-certificate Step 5: Claims (delete the namespace URI) In the Entra app go to Single sign-on › Attributes & Claims › Edit. Open each claim, clear the Namespace field completely, and make sure the names match exactly: dn: user.onpremisesdistinguishedname email: user.mail (or user.userprincipalname for UPN) family_name: user.surname given_name: user.givenname purity_roles: user.assignedroles (required for array level SSO) Step 6: Fix the app role names The Pure Storage SSO gallery app is set up incorrectly for its role names. It ships readonly_role, ops_admin_role, storage_admin_role and array_admin_role with an empty value. The names must match the FlashArray role names exactly, otherwise the login test fails because the array cannot find the role. The roles are edited in App registrations, not in the Enterprise application: Go to App registrations › All applications and search for the app name. Open App roles and click a role. In Display name, remove the _role suffix. In Value, enter the role name, for example array_admin. Click Apply and repeat for the other roles. array_admin_role → Display name: array_admin, Value: array_admin storage_admin_role → Display name: storage_admin, Value: storage_admin ops_admin_role → Display name: ops_admin, Value: ops_admin readonly_role → Display name: readonly, Value: readonly Leave msiam_access as it is. Step 7: Assign, test and enable In the Entra app go to Users and groups › Add user/group, pick the user, click Select a role and choose one of the renamed roles. Only one role per assignment. On the array open the SAML2 SSO dialog and click Test. All lines must be green and the first two must show saml-sp. Click E2E Test, sign in with the assigned user, then click Check E2E Test Result. If it passes, switch Enabled on and save. The login page now shows Click for Single Sign-On and a Local Access link. Tip: Keep a working local admin login in case something on the Entra side breaks or a certificate expires. More arrays and fleets Each array needs its own certificate, and that certificate must be uploaded to Entra under Verification certificates, next to the ones from the other arrays. You do not need a new Enterprise application per array. If you use Fusion / fleet manager, enable Trust Other SAML Service Providers In Fleet in the SAML2 SSO configuration and apply these settings on each additional array: Create the certificate on that array (Step 1) with its own common name. Use the same SSO configuration name as on the first array. Array URL: the FQDN of the new array. SP Entity ID: set it to Manual and paste the SP Entity ID of the first array. All fleet members must use the same SP Entity ID. Signing Credential and Decryption Credential: saml-sp, the certificate of this array. Switch on Sign Request and Encrypt Assertion. Identity Provider fields and Verification Certificate: the same values you used on the first array. In the Entra app, add a second Reply URL with the Assertion Consumer URL of the new array, and upload the new array's saml-sp .cer under Verification certificates. Run Test and E2E Test before enabling. After that you can sign in on the other arrays with the same Entra users, roles and claims. Note: If you use Encrypt Assertion on several arrays, check this: Entra token encryption uses one active certificate per application, so test each array with the E2E test. Troubleshooting Save fails: must provide signing or decryption credential: Create saml-sp and enter its name in both fields Red error echoes a long MIID... string: You pasted certificate text. Type the certificate name instead Test shows management as credential: Run puresso saml2 setattr as in Step 2 500 Internal Server Error when starting login: The credential was the EC management certificate. Switch to the RSA saml-sp certificate Login test fails, role not found: Rename role display name and value in App registrations (Step 6) Login fails or user has no role: Clear the claim namespaces and check purity_roles = user.assignedroles (Step 5) Verification certificate shows - in the test: Paste the Entra Base64 certificate (Step 4) If you do not need signed requests or encrypted assertions, you can switch off Sign Request and Encrypt Assertion and skip the certificate steps. Links Configure Pure Storage SSO for Single sign-on with Microsoft Entra ID (https://learn.microsoft.com/en-us/entra/identity/saas-apps/pure-storage-sso-tutorial) Configure Microsoft Entra SAML token encryption (https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption) Manage certificates for federated single sign-on (https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on) App roles UI (https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps#app-roles-ui) Hope this saves someone some time. Questions and corrections are welcome.
Interested in deploying Kubernetes in FlashArray with Portworx? Join our live labs 7/14 and 7/15.
Curious how FlashArray fits into Kubernetes? Join the live upcoming Hands-on labs for a practical, storage-admin-first look at how Portworx Enterprise extends your existing FlashArray investment into modern application environments. We’ll cover how to provision persistent storage for stateful workloads, build flexible storage pools with Cloud Drives and StorageV2, apply storage policies and QoS across teams, and automate volume growth with Portworx Autopilot. If you’re just starting with Kubernetes or already supporting multiple clusters, this session is a great way to connect your storage expertise to what’s next. Save Your Spot for the Live Labs: Americas July 14th at 9:00 AM PT – LINK EMEA July 15th at 10:00 AM CET – LINKNVMe-over-Fabrics (NVMe-oF) with Windows Server Initiator and Everpure FlashArray
Are you actively using or considering to use NVMe-oF with Linux and FlashArray? Do you know that Microsoft recently announced a preview of Windows Server NVMe-oF initiator? For those who are interested in this topic, I tested the initial preview with FlashArray and posted the results into the Everpure blog page hereAnnouncing the General Availability of Purity//FA 6.7.7 LLR
We are happy to announce the general availability of 6.7.7, the eighth release in the 6.7 Long-Life Release (LLR) line! This release line is based on the feature set introduced in 6.6, providing long-term consistency in capabilities, user experience, and interoperability, with the latest fixes and security updates. For more detailed information about bug fixes and security updates included in each release, see the release notes. UPGRADE RECOMMENDATIONS AND EOL SCHEDULE We recommend customers already running 6.7 who are looking for the latest fixes and updates to upgrade to this long-life release. Customers looking for a newer feature set, including Fusion fleet management, should consider an upgrade to the 6.9 LLR. When possible, customers should make use of Self-Service Upgrades (SSU) to ease the process of planning and executing non-disruptive Purity upgrades for their fleet. The 6.7 LLR line is planned for development through October 2027. HARDWARE SUPPORT This release is supported on the following FlashArray Platforms: FA//X (R2, R3, R4), FA//C (R1, R3, R4), FA//XL (R1), FA//E, and Pure Storage Cloud Dedicated. The PSC Dedicated release may take up to a week to be available on the AWS Marketplace and Azure Marketplace. Note, DFS software version 2.2.4 is recommended with this release LINKS AND REFERENCES Purity//FA 6.7 Release Notes Purity//FA 6.6/6.7 Feature Content Self-Service Upgrades Purity//FA Release and End-of-Life Schedule FlashArray Hardware and End-of-Support DirectFlash Shelf Software Compatibility Matrix FlashArray Capacity and Feature LimitsAnnouncing the General Availability of Purity//FA 6.9.2
We are happy to announce the general availability of 6.9.2, the third release of the 6.9 Long-Life Release (LLR) line and the thirteenth release based on the code line from 6.8! This LLR line provides long-term maintenance of the complete feature set introduced in the 6.8 Feature Release Line, including Fusion, with consistency in capabilities, user experience, and interoperability. This release includes support for R5 Controllers for FlashArray //X and //C, bringing performance, density, and data protection improvements to the 6.9 LLR line. For more detailed information about bug fixes and security updates included in each release, see the release notes. UPGRADE RECOMMENDATIONS AND EOL SCHEDULE Customers who are looking for long-term maintenance of the complete 6.8 feature set are encouraged to upgrade to the 6.9 LLR. Customers who are looking for continued delivery of all the newest capabilities as soon as they are available should upgrade to the 6.10 Feature Release line. When possible, customers should make use of Self-Service Upgrades (SSU) to ease the process of planning and executing non-disruptive Purity upgrades for their fleet. The 6.9 LLR line is planned for development through June 2028. HARDWARE SUPPORT This release is supported on the following FlashArray Platforms: FA//X (R3, R4, R5), FA//C (R3, R4, R5), FA//XL (R1, R5), FA//E, FA//RC20, and Pure Storage Cloud Dedicated (PSCD) for Azure and AWS. The PSCD release may take up to a week to be available on the AWS Marketplace and Azure Marketplace. Note, DFS software version 2.2.5 is recommended with this release. LINKS AND REFERENCES Purity//FA 6.9 Release Notes Self-Service Upgrades Purity//FA Release and End-of-Life Schedule FlashArray Hardware and End-of-Support DirectFlash Shelf Software Compatibility Matrix FlashArray Capacity and Feature Limits FlashArray Feature Interoperability MatrixAccelerate Breakout Replay: Next-generation Scale Up Architecture with FlashArray™
Discover how FlashArray//XL™ and FlashArray//C™ meet rising performance and efficiency demands—more power, less space, and cost. Speakers: Matt Hallberg Mayank Bhatnagar Andrew Miller https://www.purestorage.com/video/webinars/next-gen-scale-up-architecture-flasharray/6375772884112.htmlAccelerate Breakout Replay: Unlock Cloud Agility with Pure Storage Enterprise File
Discover how Pure Storage Real-time Enterprise File delivers scalable, resilient file storage with Pure Fusion™ fleet management, QoS, analytics, & 99.999% availability. Speakers: Jon Carnes Peter Gonzalez Jeff Wilson, ONE Gas https://www.purestorage.com/video/webinars/unlock-cloud-agility-enterprise-file/6375771412112.html
Hello All, I am a Sr. Architect with the Pure Professional Services team
Hello All, I am a Sr. Architect with the Pure Professional Services team. In our PS Delivery team, we spend a large amount of my time automating against FlashArray for various tasks, such as database refreshes, automated volume provisioning, DR/BC, zero touch provisioning, etc Recently, we have had a thought that it would be mutually beneficial for us to share our successes with the customer base, as well as create an open forum for you all to share with each other where you have had success. I have made a slack channel topic-automation-user-group where you can join if interested. If we can spark enough interest, we will attempt to meet quarterly. We will have an agenda for demos, guest speakers (including from your peers), open Q&A etc.
