SSO Identity Provider#

Integrating with an SSO Identity Provider#

This procedure configures integration with a SSO identity provider (IdP).

Note

These steps include the default menus paths that ship with the system. You can also search for a page via the toolbar Search field.

  1. Log in as Provider, Reseller, or Customer administrator (depending on your IdP configuration level).

  2. Go to (default menus) Administration Tools > File Management and upload the IdP metadata.

  3. Go to (default menus) Choose Single Sign On > SSO Identity Provider.

  4. Click Add to add the SSO Identity Provider configuration.

    Note

    Only one instance of an SSO Identity Provider can be configured for a hierarchy node.

  5. On the SSO Identity Provider screen, complete at least the mandatory fields (Entity ID, Login URI, Local Metadata File, User lookup field at minimum, the mandatory SSO Identity Provider fields (see SSO Identity Provider fields):

    If a customer is using a custom domain, the Service Provider Domain Name is filled in at the hierarchy level and the login and metadata URLs used will be tied to the IdP as follows:

    SSO Login URL:         ``https://<Service Provider Domain Name>/sso/<Login URI>/login``
    Admin Portal:          ``https://<Service Provider Domain Name>/admin/sso/<Login URI>/login``
    

    The metadata is obtained from: https://<Service Provider Domain Name>/sso/<Login URI>/metadata

    If the Service Provider Domain Name is specified, the metadata XML file from VOSS-4UC then contains Service.Provider.Domain.Name in the assertion consumer service URL as shown in the example below:

    <md:AssertionConsumerService
        Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        Location="https://Service.Provider.Domain.Name/sso/acs/"
        index="1"/>
    

    This metadata needs to be uploaded to the IdP (not the generic metadata obtained from SSO Service Provider Configuration).

    Important

    If you have previously uploaded metadata to the IDP and you subsequently complete this Service Provider Domain Name field, you need to remove the previous record from the IDP and re-upload the metadata so that it contains this field.

  6. Click Save to save the SSO Identity Provider Configuration and enable SSO if selected.

  7. Choose User Management > Users and filter on Auth Method equals SSO to display enabled SSO users.

When the Service Provider Domain Name is not specified for a given IDP, these URLs are used for SSO login:

SSO Login URL:         ``https://<FQDN of the Service Provider>/sso/<login_URI>/login``
Admin Portal:          ``https://<FQDN of the Service Provider>/admin/sso/<Login URI>/login``

See SAML SP Settings FQDN in SSO SP Settings.

The IdP redirects to this FQDN on login.

Note

While an IdP may exist at more than one hierarchy in VOSS Automate, a user will only be permitted to log in if the user exists at or below the hierarchy of a single IdP.

SSO Identity Provider: Field Reference#

Field

Description

Entity Id

Mandatory. Entity ID of the IDP. This field must exactly match the entity ID in the IdP metadata file.

Login URI

Mandatory. Login URI for the IDP. This is the URI that will be embedded in SSO Login URL. It can contain only alphanumeric characters and forward slashes.

Service Provider Domain Name

The FQDN that will be embedded in the SP metadata for this IdP for URLs that refer back to the Service Provider.

Local Metadata File

Mandatory. Choose the IdP metadata file. This field must be unique across the system.

SSO Enabled

Select the check box to enable SSO for users synced in or created at the current hierarchy level. Clear this check box to disable SSO for the users associated with the defined IDP.

Note

Reminder to upload the IdP metadata file

SSO Login URL

Read-only field displays the SSO Login URL to use. Users with selfservice role and no Authorized Admin Hierarchy will be redirected to Self-service.

Admin SSO Login URL

Read-only. Displays the new Admin Portal SSO Login URL to use.

Business Admin SSO Login URL

Read-only. Displays the new Business Admin Login URL to use. From release 21.4, this will always redirect to the new Admin Portal.

User lookup field

Mandatory. Select the field to bind the VOSS and SSO user - typically username.

Authentication Scope

Hierarchical scope this server applies to.

  • Full tree authentication (default): All nodes at and below this node in its tree can authenticate against this server.

  • Local authentication: Only users at this node can authenticate against this server.

User sync type

Type of users that can authenticate against this server.

  • Synced users only: Only users synced in from LDAP can authenticate against this server.

  • All users

For Authentication Scope, also see User Login Options by Authentication Method and Server Authentication Scope.

SSO Scenarios for User Roles#

The table maps user roles to the log in URLs - single role or multiple role (includes Authorized Admin Hierarchy):

User Role

Auth Admin?

URL used

UI (Session Limiting)

Expected Behavior

selfservice

Yes

https://<hostname>/sso/<login-uri>/login

administrator

Redirect to Admin Portal

selfservice

Yes

https://<hostname>/admin/sso/<login-uri>/login

administrator

Redirect to Admin Portal

selfservice

No

https://<hostname>/sso/<login-uri>/login

selfservice

Redirect to Self-service

administration

Yes

https://<hostname>/sso/<login-uri>/login

administrator

Redirect to Admin Portal

administration

Yes

https://<hostname>/admin/sso/<login-uri>/login

administrator

Redirect to Admin Portal

administration

No

https://<hostname>/sso/<login-uri>/login

administrator

Redirect to Admin Portal

administration

No

https://<hostname>/admin/sso/<login-uri>/login

administrator

Redirect to Admin Portal

Administrators set up with SSO but who have multiple user roles and who wish to access the Self-service interface must navigate to the Self-service portal URL upon login:

https://<Hostname>/selfservice/#/