Model: relation/HcsSsoIdpREL

SSO SP Metadata

Before You Begin

Create a self-signed or third-party-signed system certificate before you configure self-service SSO. For more information, see SSO Certificate Management.

The VOSS-4-UC server and the IdP (identify provider) server must be configured so that their clocks are synchronized.

Follow these steps to configure self-service Single Sign-On (SSO) for VOSS-4-UC. The configuration applies to the customers and customer administrators associated with the IdP.

Note

SSO support for administrative users is defined as follows:

SSO is not supported for administrative users under User Management > Local Admins because their passwords are stored locally (and so are not available for SSO).
SSO is supported for administrative users under User Management > Users, except for users with the Role set to SelfService.

Procedure

Choose Single Sign On > SSO SP Settings.

Click Add.

Note: Configure only one instance of SSO SP Settings.

On the Base tab, from the mandatory System Certificate drop-down, choose the System Certificate to use. To allow the SSO SP Setting to expire, enter a number of hours in the Validity (Hours) field.

Note:

Specifying an unsigned third-party-signed certificate will result in an error.
To renew an expired certificate, follow the steps: Renew Single Sign-On Certificate for VOSS-4-UC.

On the SAML SP Settings tab, enter the mandatory FQDN of the Server.

Select the Sign Authn Requests and Want Assertions Signed check boxes as required by your security environment.

Note that if a secure connection is required with the secure attribute set on the cookies, the URL values for bindings of End Points must be specified with https.

Click Save.

To view the location of the VOSS-4-UC SP metadata that you will upload to the IdP, choose Single Sign On > SSO SP Metadata. Point your browser to the URL shown here, and then save a copy of the SP metadata.

Upload the SP metadata to the IdP.

Refer to your IdP documentation for details on configuring SSO on your IdP.

Note:

The IdP must release the UID and map it to an appropriate attribute. For example, an IdP that authenticates with Active Directory can map the uid SAML attribute to sAMAccountName in the Active Directory server.

Download the IdP metadata from the IdP server.

Refer to your IdP documentation for details on downloading IdP metadata.

Note:

If an expired SSO certificate is being renewed and the IdP metadata has not changed, then the download, configure and upload of the IdP metadata is not required.

Choose Administration Tools > File Management and upload the IdP metadata.

Choose Single Sign On > SSO Identity Provider.

Click Add to add the SSO Identity Provider configuration.

Note: Only one instance of an SSO Identity Provider can be configured for a hierarchy node.

On the SSO Identity Provider screen, complete at minimum, the mandatory SSO Identity Provider fields (see SSO Identity Provider fields).

Click Save to save the SSO Identity Provider Configuration and enable SSO if selected.

Choose Single Sign On > SSO User to display enabled SSO users.

Use this URL for your SSO login:

https://<FQDN of the Server>/sso/<login_URI>/login

Upon login, the IdP will redirect you to this FQDN.

SSO Identity Provider Fields

Field	Description
Entity Id *	Entity ID of the IdP. This can be extracted from the IdP metadata file. This field is mandatory.
Login URI *	Login URI for the IdP. This is the URI that will be embedded in SSO Login URL. It can contain only alphanumeric characters and forward slashes. This field is mandatory.
Local Metadata File *	Choose the IdP metadata file. This field is mandatory and must be unique across the system.
SSO Enabled	Select the check box to enable SSO for users synced in or created at the current hierarchy level. Clear this check box to disable SSO for the users associated with the defined IdP.
Note	Reminder to upload the IdP metadata file
SSO Login URL	Read-only field displays the SSO Login URL to use.

Field

Description

Entity Id *

Entity ID of the IdP. This can be extracted from the IdP metadata file. This field is mandatory.

Login URI for the IdP. This is the URI that will be embedded in SSO Login URL. It can contain only alphanumeric characters and forward slashes. This field is mandatory.

Local Metadata File *

Choose the IdP metadata file. This field is mandatory and must be unique across the system.

SSO Enabled

Select the check box to enable SSO for users synced in or created at the current hierarchy level. Clear this check box to disable SSO for the users associated with the defined IdP.

Note

Reminder to upload the IdP metadata file

SSO Login URL

Read-only field displays the SSO Login URL to use.

Model Details

An asterisk * in the title indicates the field is mandatory.
If a field has a default value, it is shown in the Description column.
If the field type is an array, the Field Name has a .[n] suffix, where n is the array index placeholder.
Object and array field names are listed to provide context. If a field belongs to an object or an array, the full field name is shown in dot separated notation.

Title

Description

Details

Entity Id *

The unique identifier of the Identity Provider.

Field Name: entity_id
Type: String

This is a URI that will be embedded in the base SSO login URL in order to authenticate specifically with this IDP. This field must only contain alphanumeric characters and forward slashes, and should match the following regular expression ^\w+(/\w+)*$ Eg. Given a login URI of provider1/customer1, end users wishing to authenticate against this IDP will login via the following URL: http://hostname/sso/provider1/customer1/login/.

Field Name: login_uri
Type: String
Pattern: ^\w+(/\w+)*$

Metadata

Indicates where metadata can be found. This can be either a file accessible locally on the system or somewhere on the network.

Field Name: metadata
Type: Object

Local Metadata File

Field Name: metadata.local
Type: String
Target: data/File
Format: uri

Remote Metadata URL

Field Name: remote
Type: Object

URL

Location where metadata is to be downloaded from.

Field Name: metadata.remote.url
Type: String

Certificate

To verify the authenticity of the file downloaded from the net the local copy of the public key should be used. This public key must be acquired by some out-of-band method.

Field Name: metadata.remote.certificate
Type: String
Target: data/File
Format: uri

Field Name: loginUrl
Type: Object

IDP Entity ID

The SSO IDP Entity ID

Field Name: loginUrl.entity_id
Type: String
MaxLength: 1024

SSO Login URL

The URL will be updated after you add SSO IDP .

Field Name: loginUrl.login_url
Type: String
MaxLength: 1024

Note

Reminder for Uploading IDP Metadata file first.

Field Name: loginUrl.note
Type: String
MaxLength: 1024

SSO Enabled

This boolean indicates SSO has been enabled for this IDP or not?

Field Name: loginUrl.sso_enabled
Type: Boolean