[Index]

Model: relation/HcsSsoSpREL

SSO Identity Provider

To access the latest documentation, go to Documentation and Resources at: https://voss.portalshape.com

This procedure configures self-service Single Sign-On (SSO) for VOSS Automate.

The configuration applies to customers and customer administrators associated with the identify provider (IdP).

Prerequisites

• Create a self-signed or third-party-signed system certificate. For more information, see SSO Certificate Management.
• The VOSS Automate server and the IdP server must be configured so that their clocks are synchronized.

SSO Service Provider Configuration

1. Log in to VOSS Automate as system administrator.

2. Choose Single Sign On > SSO SP Settings.

   Note

   This screen is only available to you if you've logged in as a higher-level administrator.

3. Click Add.

   Note

   Configure only one instance of SSO SP Settings.

4. On the Base tab:

   • (Mandatory). From the System Certificate drop-down, choose the System Certificate to use. See SSO Certificate Management.
   • To allow the SSO SP Setting to expire, enter a number of hours in the Validity (Hours) field.

   Note

   • Specifying an unsigned third-party-signed certificate results in an error.
   • To renew an expired certificate, see Renew Single Sign-On Certificate for VOSS Automate.

5. On the SAML SP Settings tab:

   • Enter the mandatory FQDN of the Server.
   • Select the Sign Authn Requests and Want Assertions Signed check boxes as required by your security environment.

   Note

   • Only select Want Reponse Signed if you're sure that all IdPs sign responses.
   • If a secure connection is required with the secure attribute set on the cookies, the URL values for bindings of End Points must be specified with https.

6. Click Save.

7. To view the location of the VOSS Automate SP metadata that you will upload to the IdP:

   • Choose Single Sign On > SSO SP Metadata.
   • Point your browser to the URL shown here, and then save a copy of the SP metadata.

8. Upload the SP metadata to the IdP.

   Refer to your IdP documentation for details on adding VOSS Automate as a service provider.

   Note

   The IdP must release the UID and map it to an appropriate attribute. For example, an IdP that authenticates with Active Directory can map the uid SAML attribute to sAMAccountName in the Active Directory server.

9. Download the IdP metadata from the IdP server.

   Refer to your IDP documentation for details on downloading IDP metadata.

   Note

   If an expired SSO certificate is being renewed and the IdP metadata has not changed, the download, configure and upload of the IdP metadata is not required.

Integrating with an SSO Identity Provider

1. Log in as provider, reseller, or customer administrator (depending on your IdP configuration level).

2. Choose Administration Tools > File Management and upload the IdP metadata.

3. Choose Single Sign On > SSO Identity Provider.

4. Click Add to add the SSO Identity Provider configuration.

   Note

   Only one instance of an SSO Identity Provider can be configured for a hierarchy node.

5. On the SSO Identity Provider screen, complete at least the mandatory fields (Entity ID, Login URI, Local Metadata File, User lookup field at minimum, the mandatory SSO Identity Provider fields (see SSO Identity Provider fields):

   If a customer is using a custom domain, the Service Provider Domain Name is filled in at the hierarchy level and the login and metadata URLs used will be tied to the IdP as follows:

   SSO Login URL:         ``https://<Service Provider Domain Name>/sso/<Login URI>/login``
   Admin Portal:          ``https://<Service Provider Domain Name>/admin/sso/<Login URI>/login``
   Business Admin Portal: ``https://<Service Provider Domain Name>/business-admin/sso/<Login URI>/login``
   

   The metadata is obtained from: https://<Service Provider Domain Name>/sso/<Login URI>/metadata

   If the Service Provider Domain Name is specified, the metadata XML file from VOSS-4UC then contains Service.Provider.Domain.Name in the assertion consumer service URL as shown in the example below:

   <md:AssertionConsumerService
       Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
       Location="https://Service.Provider.Domain.Name/sso/acs/"
       index="1"/>
   

   This metadata needs to be uploaded to the IdP (not the generic metadata obtained from SSO Service Provider Configuration).

   Important

   If you have previously uploaded metadata to the IDP and you subsequently complete this Service Provider Domain Name field, you need to remove the previous record from the IDP and re-upload the metadata so that it contains this field.

6. Click Save to save the SSO Identity Provider Configuration and enable SSO if selected.

7. Choose User Management > Users and filter on Auth Method equals SSO to display enabled SSO users.

When the Service Provider Domain Name is not specified for a given IDP, these URLs are used for SSO login:

SSO Login URL:         ``https://<FQDN of the Service Provider>/sso/<login_URI>/login``
Admin Portal:          ``https://<FQDN of the Service Provider>/admin/sso/<Login URI>/login``
Business Admin Portal: ``https://<FQDN of the Service Provider>/business-admin/sso/<Login URI>/login``

See SAML SP Settings FQDN in SSO Service Provider Configuration.

The IdP redirects to this FQDN on login.

SSO Identity Provider: Field Reference

For Authentication Scope, also see User Login Options by Authentication Method and Server Authentication Scope.

SSO Scenarios for User Roles

The table below shows the interface a user will be directed to when using a specific SSO URL, according to the user's role: either single role or multiple role (includes Authorized Admin Hierarchy).

Administrators set up with SSO but who have multiple user roles and who wish to access the Self-service interface must navigate to the Self-service portal URL upon login:

https://<Hostname>/selfservice/#/

Model Details: relation/HcsSsoSpREL