---
metadata:
  - name: generator
    content: Diplodoc Platform v5.50.3
alternate:
  - https://yandex.uz/support/yandex-360/business/admin/ru/sso/setup.md
  - https://yandex.uz/support/yandex-360/business/admin/uz/sso/setup.md
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.uz/support/yandex-360/business/admin/uz/llms.txt

# Qanday ulanadi

Agar sizda [sertifikat provayderi](*p_idp) ulangan va sozlangan bo‘lsa, uni Yandex 360 xizmatiga ulashingiz mumkin. Buning uchun siz [guvohnomalar federatsiyasini](#idp), keyin esa [Biznes uchun Yandex 360](#admin) ni sozlashingiz kerak.

## Tashkilot talablari {#requirements}


{% note tip "" %}

SSO **Rivojlangan** va **Asosiy** tariflarida mavjud. **Asosiy** tarif rejasiga almashsangiz, SSO tarifi faolsizlantiriladi.

{% endnote %}


Yagona kirish (SSO) sozlamalariga o‘tishdan oldin tashkilotingizda quyidagilar borligini tekshiring:

- SSO mavjud tarif ulangan.

- [Domen](https://yandex.uz/support/yandex-360/business/admin/uz/domains/index.md) ulandi.

- Hech qanday [tashkilot domenida yaratilgan](https://yandex.uz/support/yandex-360/business/admin/uz/add-users.md) xodim hisobi topilmadi. Xodimlarning domen hisoblari — `login@example.com` ko‘rinishidagi manzillarga ega hisoblar, bu yerda `@example.com` tashkilotingiz nomi (domen). Bunday hisoblar tashkilot administratori tomonidan **Foydalanuvchilar** → **Xodimlar** ruknida oddiy usulda kiritiladi.

## 1-qadam. Guvohnoma federatsiyasini sozlang {#idp}

[Guvohnomalar federatsiyasi](*p_federations) Yandex 360 bilan ishlay olishi uchun uni sozlash kerak.

Turli sertifikat provayderlari uchun buni qanday amalga oshirish haqida quyidagi bo‘limlarda o‘qing:

- [Active Directory sozlanishi](https://yandex.uz/support/yandex-360/business/admin/uz/sso/adfs-preset.md)

- [Azure Active Directory sozlanishi](https://yandex.uz/support/yandex-360/business/admin/uz/sso/adfs-azure-preset.md)

- [Keycloak 18-versiyasini sozlash](https://yandex.uz/support/yandex-360/business/admin/uz/sso/keycloak-preset-18.md)

- [Keycloak 19 va undan yuqori versiyasini sozlash](https://yandex.uz/support/yandex-360/business/admin/uz/sso/keycloak-preset-19.md)

- [Avanpost FAM sozlash](https://yandex.uz/support/yandex-360/business/admin/uz/sso/avanpost.md)

- [Multifactor sozlamasi](https://yandex.uz/support/yandex-360/business/admin/uz/sso/multifactor.md)

Guvohnoma provayderingiz siz foydalanadigan katalog xizmatiga mos kelishini tekshiring. Muvofiqliklar jadvalda keltirilgan.

#|
|| **Katalog xizmati** | **Guvohnoma provayderi** ||
|| Microsoft Active Directory 
| 
* Microsoft AD FS
* Keycloak
* Avanpost FAM
* Multifactor ||
|| Samba DC 
| 
* Keycloak
* Avanpost FAM
* Multifactor ||
|| Red ADM 
| 
* Keycloak
* Avanpost FAM
* Multifactor ||
|| ALD Pro 
| 
* Keycloak
* Avanpost FAM
* Multifactor ||
|| FreeIPA 
| 
* Keycloak
* Avanpost FAM
* Multifactor ||
|#

Agar sizda boshqa guvohnoma provayderi bo‘lsa, uning hujjatlari bilan tanishib chiqing. Shuningdek, ko‘rsatmalarimizdan foydalanishingiz mumkin. Sozlashda quyidagi parametrlarni ko‘rsating:

- Service URL: `https://passport.yandex.ru/auth/sso/commit`.

- Identifikator — `https://yandex.ru/` (oxirida qiyshiq chiziq bo‘lishi shart).

- Agar xodimlaringiz xizmatlardan faqat rus tilida foydalanmasa, `POST` havolasi bilan boshqa til domenlarining URL manzillarini oxirgi nuqtalar (Endpoints) sifatida qo‘shing. Masalan:
    
  - `https://passport.yandex.com/auth/sso/commit` — ingliz tili uchun;

  - `https://passport.yandex.kz/auth/sso/commit` — qozoq tili uchun;

  - `https://passport.yandex.uz/auth/sso/commit` — o‘zbek tili uchun;

  - `https://passport.yandex.com.tr/auth/sso/commit` — turk tili uchun.

   

  {% cut "To‘liq ro‘yxat" %}
    
    - `https://passport.yandex.com/auth/sso/commit`
    
    - `https://passport.yandex.az/auth/sso/commit`
    
    - `https://passport.yandex.by/auth/sso/commit`
    
    - `https://passport.yandex.co.il/auth/sso/commit`
    
    - `https://passport.yandex.com/auth/sso/commit`
    
    - `https://passport.yandex.com.am/auth/sso/commit`
    
    - `https://passport.yandex.com.ge/auth/sso/commit`
    
    - `https://passport.yandex.com.tr/auth/sso/commit`
    
    - `https://passport.yandex.ee/auth/sso/commit`
    
    - `https://passport.yandex.eu/auth/sso/commit`
    
    - `https://passport.yandex.fi/auth/sso/commit`
    
    - `https://passport.yandex.fr/auth/sso/commit`
    
    - `https://passport.yandex.kg/auth/sso/commit`
    
    - `https://passport.yandex.kz/auth/sso/commit`
    
    - `https://passport.yandex.lt/auth/sso/commit`
    
    - `https://passport.yandex.lv/auth/sso/commit`
    
    - `https://passport.yandex.md/auth/sso/commit`
    
    - `https://passport.yandex.pl/auth/sso/commit`
    
    - `https://passport.yandex.ru/auth/sso/commit`
    
    - `https://passport.yandex.tj/auth/sso/commit`
    
    - `https://passport.yandex.tm/auth/sso/commit`
    
    - `https://passport.yandex.uz/auth/sso/commit`
    
  {% endcut %}
    

Shuningdek, kirish sahifasi URL, sertifikat provayderingiz ID va X.509 tasdiqlash sertifikatini oling. Quyidagi qadamda sizga zarur bo‘ladi.


## 2-qadam. Biznes uchun Yandex 360 platformasini sozlang {#admin}

1. [Biznes uchun Yandex 360](https://admin.yandex.uz) oching.

1. **Umumiy sozlamalar** → **Yagona kirish (SSO)** rukniga kiring.

1. **Sozlash**ni bosing.

1. Majburiy parametrlarga ega maydonlarni to‘ldiring:
    
    - **Kirish URL** — SAML 2.0 yakuniy nuqtasi URL manzili.

    - **Sertifikat provayderi noshiri** — IdP subyekti ID raqami.

    - **Tekshiruv sertifikati** — sertifikat provayderining sertifikati.

      Agar joriy sertifikat muddati tez orada tugasa, uning o‘rniga ikkinchisini qo‘shishingiz mumkin — buning uchun **Yangilash uchun ikkinchi sertifikat qo‘shish** tugmasini bosing.
    
1. LDAP kataloglaridan hisoblarni sinxronlash uchun: Yandex 360 platformasidagi xodimlar ro‘yxatini avtomatik yangilash uchun [sinxronlashni sozlang](https://yandex.uz/support/yandex-360/business/admin/uz/sso/scim.md) va **SCIM sinxronizatsiyasi** blokida ilovangiz identifikatorini kiriting.

1. O‘zgarishlarni saqlang.

1. **Yoqish** tugmasini bosing.


## 3-qadam. Autentifikatsiyani tekshirish {#testing}

1. Brauzerni mehmon rejimida yoki inkognito rejimida oching.

1. [passport.yandex.uz/auth](https://passport.yandex.uz/auth) sahifasiga kiring, guvohnoma provayderidan hisobingizni kiriting va **Kirish** tugmasini bosing. Agar hammasi to‘g‘ri sozlangan bo‘lsa, 2-qadamda ko‘rsatilgan kirish sahifasiga yo‘naltirilasiz.


## Muammolarni tuzatish va tuzatish {#troubleshooting}

Agar sertifikat provayderini sozlash jarayonida noto‘g‘ri qiymatlar berilgan bo‘lsa, SSO orqali kirishga uringaningizda “Avtorizatsiya muvaffaqiyatsiz” xabarini va xato kodini ko‘rasiz:

**email.no_in_response**

 
:   `User.Firstname`, `User.Surname`, `User.EmailAddress` formatida atribut nomlari kiriting. Agar boshqa format, masalan, `Ism` berilsa, avtorizatsiya qilinmaydi.

**request_your_admin**

 
:   Tashkilotingiz foydalanuvchilari katalogi administratori hisob uchun Yandex 360 platformasiga kirishni cheklagan bo‘lsa, xatolik yuz beradi. Batafsil ma’lumot olish uchun tashkilotingizning texnik yordam mutaxassislariga murojaat qiling.

**samlresponse.invalid**

 
:   Agar kirish sahifasi URL, guvohnomalar emitenti yoki tekshiruv sertifikati noto‘g‘ri ko‘rsatilgan bo‘lsa, xatolik yuz beradi. Shuningdek, u tekshiruv sertifikatining amal qilish muddati tugashidan oldin yoki uning amal qilish muddati tugagandan keyin 14 kun ichida yuzaga kelishi mumkin. [Biznes uchun Yandex 360](https://admin.yandex.uz) SSO sozlamalari to‘g‘riligini tekshiring.

**unsupportable_domain**

 
:   `User.EmailAddress` pochta atributidagi domen SAML javobidagi asosiy domen yoki Yandex 360 tashkilotining [alias domenlaridan](https://yandex.uz/support/yandex-360/business/admin/uz/domains/management/aliases.md) biri bilan bir xil ekanligini tekshiring.

### Muammolarni tuzatish uchun SAML-treker {#saml-tracer}

SAML-tracer — bu SAML hodisalarini kuzatadigan, yagona kirish (SSO) ni sozlashda xatolarni topish va tuzatishga yordam beradigan brauzer kengaytmasi. Tekshiruv hisobotini `JSON` fayliga eksport qilish mumkin.

**O‘rnatish va ishga tushirish**

 
:   Kengaytmani havola orqali o‘rnating:
    - [SAML-tracer](https://chromewebstore.google.com/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch) — Yandex Brauzer, Google Chrome va Microsoft Edge uchun;
    - Mozilla Firefox uchun [SAML-tracer](https://addons.mozilla.org/es/firefox/addon/saml-tracer/).

    SAML-tracerni ishga tushirish uchun brauzer kengaytmalari panelidagi ![](../_assets/sso/saml-tracer-icon.png) belgisini yoki klaviaturadagi `Alt` + `Shift` + `s` kombinatsiyasini bosing.

**SAML hodisalarini kuzatish**

 
:    
1. Brauzerni mehmon yoki inkognito rejimida oching va SAML-trekerni ishga tushiring. Agar ![](../_assets/sso/saml-tracer-icon.png) belgisi mavjud bo‘lmasa yoki SAML-tracer oynasi ochilmagan bo‘lsa, Kengaytma sozlamalarida **Yashirincha foydalanishga ruxsat** bandini yoqing.
1. [passport.yandex.uz/auth](https://passport.yandex.uz/auth) sahifasiga kiring, guvohnoma provayderidan hisobingizni kiriting va **Kirish** tugmasini bosing. SAML-tracer oynasida `GET` va `POST` yozuvlari paydo bo‘ladi, SAML-hodisalar to‘q sariq rang va yorliq bilan ajratiladi.
1. Atributlar va ularning qiymatlarini tekshirish uchun SAML hodisa yozuvini tanlang va razm solish panelidagi **SAML** varag‘iga o‘ting.

**Hisobotni faylga eksport qilish**

 
:    
1. SAML tadbirli yozuvni tanlang.
1. SAML-tracer asboblar panelida **Export** tugmasini bosing.
1. Maxfiy axborotni berkitish uchun **Mask values** bandini tanlang.
1. **Export** tugmasini bosing. `JSON` formatidagi fayl kompyuteringizga yuklab olinmoqda.


## Yagona kirish (SSO) yoniqligida cheklovlar {#restrictions}

Yagona kirishni (SSO) yoqqaningizdan keyin tashkilot uchun [xodimlarni import qilish](https://yandex.uz/support/yandex-360/business/admin/uz/migration/mail.yaml) va [bo‘limlarni ko‘chirish](https://yandex.uz/support/yandex-360/business/admin/uz/units.md#unit-actions) ishlamaydi.

Agar siz ham [ADSCIM](https://yandex.uz/support/yandex-360/business/admin/uz/sso/scim.md#setup) xizmatini ulagan bo‘lsangiz, [Biznes uchun Yandex 360](https://admin.yandex.uz) interfeysi orqali [pochta aliaslarini](https://yandex.uz/support/yandex-360/business/admin/uz/mail/mailbox-management/aliases.md) boshqarish o‘chiriladi.

Agar biznes uchun Yandex 360 bir nechta tashkilotlardan foydalansangiz va yagona kirish (SSO) ni ulashga qaror qilsangiz, u bir vaqtning o‘zida barcha tashkilotlar uchun yoqiladi.


Yagona kirishni o‘chirish (SSO) ham xuddi shunday ishlaydi. Agar tashkilotlardan birida Minimal tarifga o‘tsangiz, bu tashkilotda va boshqalarda yagona kirish o‘chiriladi.


<!-- source: uz/_includes/support.md -->
<div class="cut-button">

{% cut "Yordam xizmatiga yozish" %}

<div style="padding: 15px;
     margin: 10px 0;
     background: #FFFFFF;
     border-radius: 10px;
     border: 1px solid var(--g-color-line-generic);">
  <iframe style="background: #FFFFFF;"
        height="700"
        width="100%"
        frameborder="0"
        src="https://forms.yandex.ru/surveys/13644898.817cbb556eb020610f8656d8169ae4bc37238a00/?lang=uz&locale=uz&iframe=1">
  </iframe>
</div>

{% endcut %}

</div>



<!-- endsource: uz/_includes/support.md -->

[*p_idp]: Active Directory yoki Keycloak kabi foydalanuvchi guvohnomalarini saqlaydigan va ularni boshqaradigan xizmat.

[*p_federations]: Guvohnomalar federatsiyasi yagona kirish texnologiyasi yordamida foydalanuvchilar autentifikatsiyasini sozlash imkonini beradi — Single Sign-On (SSO). Bunday yondashuvda, Active Directory yoki Keycloak kabi guvohnomalar ta’minotchisi (IdP) foydalanuvchilar autentifikatsiyasi uchun javob beradi va xizmat yoki ilova kabi xizmat ta’minotchisi (SP) resurslarga kirishni boshqaradi.