[Index]

Model: data/SsoUser

SSO Identity Provider

Full HTML Help

Integrating with an SSO Identity Provider

This procedure configures integration with a SSO identity provider (IdP).

1. Log in as Provider, Reseller, or Customer administrator (depending on your IdP configuration level).

2. Go to (default menus) Administration Tools > File Management and upload the IdP metadata.

3. Go to (default menus) Single Sign On > SSO Identity Provider, then click the Plus (+) icon to add the SSO Identity Provider configuration.

   Note

   Only one instance of an SSO Identity Provider can be configured for a hierarchy node.

   While an IdP may exist at more than one hierarchy in VOSS Automate, a user will only be permitted to log in if the user exists at or below the hierarchy of a single IdP.

4. On the SSO Identity Provider configuration page, complete at least the mandatory settings:

   • Entity ID
   • Login URI
   • Local Metadata File
   • User lookup field

5. At UID Attribute Name, if a custom attribute is used as the UID from the identity provider (IdP), then use this attribute as the UID attribute name.

   Automate evaluates the value in UID Attribute Name first as the UID to identify the user and is for example used as an alternative user identifier when the default UID record is not present.

   If this value is not present, the default UID record is used to identify the user. For example, if the UID attribute is not mapped on the identity provider (IdP) and an attribute ElectronicMail is mapped to mail on the (IdP), the User lookup field on the SSO identity provider should be the value from the email field in Automate, and the value for UID Attribute Name should be ElectronicMail (the attribute returned by the IdP).

   The full URL of a claim in the assertion may be used as the UID attribute name together with the mapped field on User.

   The SAML response may include claims attributes configured on the IdP as follows:

   'http:\/\/schemas.microsoft.com\/identity\/claims\/objectidentifier': ['e333df87-4321-4889-852e-45c291234a2b'],
   'http:\/\/schemas.microsoft.com\/identity\/claims\/displayname': ['Users_Display_Name'],
   ...
   'http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/name': ['User@some_domain.com']
   

   If 'User@some_domain.com' maps to username in Automate, the SSO may be configured as follows:

   • User lookup field = username
   • UID Attribute Name = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

6. At Service Provider Domain Name, if a customer is using a custom domain, the value for service provider domain name is filled out at the hierarchy level and the login and metadata URLs used will be tied to the IdP as follows:

   SSO Login URL:         ``https://<Service Provider Domain Name>/sso/<Login URI>/login``
   Admin Portal:          ``https://<Service Provider Domain Name>/admin/sso/<Login URI>/login``
   

   The metadata is obtained from: https://<Service Provider Domain Name>/sso/<Login URI>/metadata

   If the service provider domain name is specified, the metadata XML file from Automate then contains Service.Provider.Domain.Name in the assertion consumer service URL as shown in the example below:

   <md:AssertionConsumerService
       Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
       Location="https://Service.Provider.Domain.Name/sso/acs/"
       index="1"/>
   

   This metadata needs to be uploaded to the IdP (not the generic metadata obtained from SSO Service Provider Configuration).

   Important

   If you have previously uploaded metadata to the IDP and you subsequently complete this Service Provider Domain Name field, you need to remove the previous record from the IdP and re-upload the metadata so that it contains this field.

   If the service provider domain name is not specified for a given IdP, the following URLs formats are used for SSO login:

   SSO login URL:         ``https://<FQDN of the Service Provider>/sso/<login_URI>/login``
   Admin Portal:          ``https://<FQDN of the Service Provider>/admin/sso/<Login URI>/login``
   

   The IdP redirects to this FQDN on login.

7. Click Save to save the SSO IdP configuration and enable SSO if selected.

8. Go to User Management > Users and filter on Auth Method equals SSO to display enabled SSO users.

Related topics

• See SAML SP Settings FQDN in SSO SP Settings

SSO Identity Provider (IdP) Settings

The table describes the configuration settings on the SSO Identity Provider page:

Related topics

• For further details on authentication scope, see also User Login Options by Authentication Method and Server Authentication Scope

SSO Scenarios for User Roles

The table maps user roles to the log in URLs - single role or multiple role (includes Authorized Admin Hierarchy):

Administrators set up with SSO but who have multiple user roles and who wish to access the Self-service interface must navigate to the Self-service portal URL upon login:

https://<Hostname>/selfservice/#/

Maps an SSO user to a data user instance (data/User).

Model Details: data/SsoUser