[Index]

Model: relation/HcsSsoIdpREL

SSO SP Metadata

Before You Begin

Create a self-signed or third-party-signed system certificate before you configure self-service SSO. For more information, see SSO Certificate Management.

The VOSS-4-UC server and the IDP (identify provider) server must be configured so that their clocks are synchronized.

Follow these steps to configure self-service Single Sign-On (SSO) for VOSS-4-UC. The configuration applies to the customers and customer administrators associated with the IDP.

Note

Administrators are configured for SSO use via the Users form (default menu User Management > Users).

SSO Service Provider Configuration

  1. Log in to VOSS-4-UC as system administrator.

  2. Choose Single Sign On > SSO SP Settings.

  3. Click Add.

    Note: Configure only one instance of SSO SP Settings.

  4. On the Base tab, from the mandatory System Certificate drop-down, choose the System Certificate to use. See SSO Certificate Management.

    To allow the SSO SP Setting to expire, enter a number of hours in the Validity (Hours) field.

    Note

    • Specifying an unsigned third-party-signed certificate will result in an error.
    • To renew an expired certificate, follow the steps: Renew Single Sign-On Certificate for VOSS-4-UC.

  5. On the SAML SP Settings tab, enter the mandatory FQDN of the Server. Select the Sign Authn Requests and Want Assertions Signed check boxes as required by your security environment.

    Note

    Only select Want Reponse Signed if you are sure that all Identity Providers sign responses.

    Note that if a secure connection is required with the secure attribute set on the cookies, the URL values for bindings of End Points must be specified with https.

  6. Click Save.

  7. To view the location of the VOSS-4-UC SP metadata that you will upload to the IDP, choose Single Sign On > SSO SP Metadata. Point your browser to the URL shown here, and then save a copy of the SP metadata.

  8. Upload the SP metadata to the IDP.

    Refer to your IDP documentation for details on adding VOSS-4-UC as a service provider.

    Note:

    The IDP must release the UID and map it to an appropriate attribute. For example, an IDP that authenticates with Active Directory can map the uid SAML attribute to sAMAccountName in the Active Directory server.

  9. Download the IDP metadata from the IDP server.

    Refer to your IDP documentation for details on downloading IDP metadata.

    Note:

    If an expired SSO certificate is being renewed and the IDP metadata has not changed, then the download, configure and upload of the IDP metadata is not required.

Integrating with an SSO Identity Provider

  1. Log in as provider, reseller, or customer administrator, depending on your IDP configuration level.

  2. Choose Administration Tools > File Management and upload the IDP metadata.

  3. Choose Single Sign On > SSO Identity Provider.

  4. Click Add to add the SSO Identity Provider configuration.

    Note: Only one instance of an SSO Identity Provider can be configured for a hierarchy node.

  5. On the SSO Identity Provider screen, complete at minimum, the mandatory SSO Identity Provider fields (see SSO Identity Provider fields).

    If a customer is using a custom domain, the Service Provider Domain Name is filled in at the hierarchy level and the login and metadata URLs used will be tied to the IDP as follows:

    https://<Service Provider Domain Name>/sso/<Login URI>/login

    The metadata is obtained from:

    https://<Service Provider Domain Name>/sso/<Login URI>/metadata

    If the Service Provider Domain Name is specified, the metadata XML file from VOSS-4UC then contains Service.Provider.Domain.Name in the assertion consumer service URL as shown below:

    <md:AssertionConsumerService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Location="https://Service.Provider.Domain.Name/sso/acs/"
    index="1"/>

    This metadata needs to be uploaded to the IDP as opposed to the generic metadata obtained from SSO Service Provider Configuration.

    Important

    If you have previously uploaded metadata to the IDP and you subsequently complete this Service Provider Domain Name field, you need to remove the previous record from the IDP and re-upload the metadata so that it contains this field.

  6. Click Save to save the SSO Identity Provider Configuration and enable SSO if selected.

  7. Choose User Management > Users and filter on Auth Method equals SSO to display enabled SSO users.

When the Service Provider Domain Name is not specified for a given IDP, the following URL is to be used for SSO login:

https://<FQDN of the Service Provider>/sso/<login_URI>/login

(See SAML SP Settings FQDN in SSO Service Provider Configuration.)

Upon login, the IDP will redirect to this FQDN.

Note

While an IDP may exist at more than one hierarchy in VOSS-4-UC, a user will only be permitted to log in if the user exists at or below the hierarchy of a single IDP.

SSO Identity Provider Fields

Field Description
Entity Id * Entity ID of the IDP. This field must exactly match the entity ID in the IDP metadata file. This field is mandatory.
Login URI * Login URI for the IDP. This is the URI that will be embedded in SSO Login URL. It can contain only alphanumeric characters and forward slashes. This field is mandatory.
Service Provider Domain Name The FQDN that will be embedded in the SP metadata for this IDP for URLs that refer back to the Service Provider.
Local Metadata File * Choose the IDP metadata file. This field is mandatory and must be unique across the system.
SSO Enabled Select the check box to enable SSO for users synced in or created at the current hierarchy level. Clear this check box to disable SSO for the users associated with the defined IDP.
Note Reminder to upload the IdP metadata file
SSO Login URL Read-only field displays the SSO Login URL to use.
User lookup field Select the field to bind the VOSS and SSO user - typically username.
Authentication Scope

Hierarchical scope this server applies to.

  • Full tree authentication (default): All nodes at and below this node in its tree can authenticate against this server.
  • Local authentication: Only users at this node can authenticate against this server.
User sync type

Type of users that can authenticate against this server.

  • Synced users only: Only users synced in from LDAP can authenticate against this server.
  • All users

Model Details: relation/HcsSsoIdpREL

Title Description Details
Entity Id * The unique identifier of the Identity Provider.
  • Field Name: entity_id
  • Type: String
Login URI This is a URI that will be embedded in the base SSO login URL in order to authenticate specifically with this IDP. This field must only contain alphanumeric characters and forward slashes, and should match the following regular expression ^\w+(/\w+)*$ Eg. Given a login URI of provider1/customer1, end users wishing to authenticate against this IDP will login via the following URL: http://hostname/sso/provider1/customer1/login/.
  • Field Name: login_uri
  • Type: String
  • Pattern: ^\w+(/\w+)*$
Service Provider Domain Name This is a FQDN that will be embedded in the SP metadata for this IDP for URLs that refer back to the Service Provider (eg ACS). It should match the customer-specific FQDN used for the VOSS-4-UC server.
  • Field Name: sp_fqdn
  • Type: String
  • Format: host-name
User lookup field User field used to bind SSO user with VOSS user. Default: username
  • Field Name: user_lookup_field
  • Type: String
  • Default: username
Metadata Indicates where metadata can be found. This can be either a file accessible locally on the system or somewhere on the network.
  • Field Name: metadata
  • Type: Object
Local Metadata File
  • Field Name: metadata.local
  • Type: String
  • Target: data/File
  • Format: uri
Remote Metadata URL
  • Field Name: remote
  • Type: Object
URL Location where metadata is to be downloaded from.
  • Field Name: metadata.remote.url
  • Type: String
Certificate To verify the authenticity of the file downloaded from the net the local copy of the public key should be used. This public key must be acquired by some out-of-band method.
  • Field Name: metadata.remote.certificate
  • Type: String
  • Target: data/File
  • Format: uri
Authentication settings Authentication settings.
  • Field Name: authentication
  • Type: Object
Authentication Scope Hierarchical scope this server applies to Default: Down
  • Field Name: authentication.scope
  • Type: String
  • Default: Down
  • Choices: ["Current hierarchy level only", "Current hierarchy level and below"]
User Sync Type Type of users that can authenticate against this server. Default: All
  • Field Name: authentication.user_type
  • Type: String
  • Default: All
  • Choices: ["LDAP synced users only", "All users"]
Login Url
  • Field Name: loginUrl
  • Type: Object
IDP Entity ID The SSO IDP Entity ID
  • Field Name: loginUrl.entity_id
  • Type: String
  • MaxLength: 1024
SSO Login URL The URL will be updated after you add SSO IDP .
  • Field Name: loginUrl.login_url
  • Type: String
  • MaxLength: 1024
Note Reminder for Uploading IDP Metadata file first.
  • Field Name: loginUrl.note
  • Type: String
  • MaxLength: 1024