Download This Guide
Configuring a Single Sign-On Server
Use this page to configure a single sign-on server (SSO) that is used for authenticating users. There are two entities involved during the SSO configuration:
- SSO Server or Identity Provider—An external server integrated with CSO.
- Service Provider—Acts as an SP and receives the Security Assertion Markup Language (SAML) assertion sent by the SSO server in a response to a login request.
Both the identity provider and service provider trust each other and configuration is required for both the entities. Two use cases are possible:
- Identity provider is configured first before SSO server is added in CSO—The identity provider is configured first, and the MSP administrator then adds the SSO server in CSO, and enters the server name and metadata URL.
- IdP is configured after SSO server is added in CSO—Enter the SSO server name and then click the Next button. CSO provides a list of URLs to be configured in the identity provider. After the identity provider is configured with the URLs, you can edit the SSO server name and enter the metadata URL.
 | Note: For both the use cases, the metadata URL is required before you use the SSO server. |
To configure an SSO server:
- Select Administration > Authentication.
The Authentication page appears.
- Click the plus icon (+) in the Single Sign-On Server section.
The Add Single Sign-On Server page appears.
- Complete the configuration according to the guidelines Table 1.
- Click Save to save the changes. If you want to discard the changes, click Cancel instead.
- After you configure both the SSO Server and CSO, click
the Test Login button from the Authentication page.
The SSO login page appears and shows the SAML attributes.
Note: You must specify the metadata URL before you click the Test Login button. If you click the Test Login button without entering the metadata URL, an error message indicating that the metadata URL must be specified is displayed.
Table 1: Fields on the Single Sign-On Server Page
Field | Description |
|---|---|
| Basic Info | |
SSO Server Name | Specify the name of the SSO server. You can use a string of alphanumeric characters, special characters such as the underscore (_) or the period (.), and spaces. The maximum length is 40 characters. |
Description | Enter a meaningful description for the SSO server. |
Metadata URL | Enter the URL from where the application metadata needs to be downloaded. |
| SAML Settings | |
SAML URLs | CSO displays the SAML URL settings. The administrator use this information to configure the IdP. |
Single Sign-On URL | Displays the SAML Assertion Consumer Service (ACS) URL for the application. Example: https://aaa-example.com/ssol/sso server name/SAML2/POST |
Audience URI (SP Entity ID) | Displays the service provider entity ID of the application. Example: https://aaa-example.com/Shibboleth |
Metadata URL | Displays the metadata URL of the application. Example: https://aaa-example.com/saml/metadata/64000 |
Download Metadata | Click this option to download metadata from the application. The administrator can download the CSO metadata and use the metadata to configure the identity provider instead configuring individual identity provider fields at a time. |
| SAML Attributes | The identity provider needs to provide the SAML attributes if the authentication method is configured as Authentication and Authorization with SSO Server. Note: No SAML attributes are required if the authentication method is configured as Authentication with SSO Server. |
tenant | This attribute is required when the Tenant User is authenticated. The value of this attribute should match with the tenant name used when the tenant was onboarded. Note: This field is not required for users with the MSP Admin and MSP Operator roles. |
role | This attribute has four values. See Table 2. |
Table 2: Attribute Values and Roles
Attribute Value | Role |
|---|---|
cloud-admin | MSP Admin |
cloud-operator | MSP Operator |
tenant-admin | Tenant Admin |
tenant-operator | Tenant Operator |
