sso + regular login

[User42243772]

dear support, as we finally got to get sso working (#SR 4-23779705421) it turned out that idp passes plain username to epo, and therefore domain-group-membership-based dynamic permission set assignments don't work. 1. we'd need help w that. 2. is it possible, to allow a single epo domain user to be able to login with saml as well as with password? thank you in advance, best regards, Ambrus Jenofi

[tlm387 · Accepted solution]

Checking SR 4-23779705421 I see it was for setting up SSO with On-Prem ePO. The On-Prem ePO SAML extension does not support dynamically assigned permissions sets. 

After a user authenticates via SAML, they need to request the Trellix ePO - On-prem administrator to manually apply the required permissions sets to the new user created via the SAML. The workflow is defined here: 

https://docs.trellix.com/bundle/trellix-epolicy-orchestrator-on-prem-5.10.0-product-guide/page/GUID-... 

For the 2nd question: No, it is not possible to allow a single ePO domain user to login with SAML and with an ePO authenticated password. Each user listed in the ePO user management page can only have a single authentication type applied.