Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configuring a Single Sign-On Server

Use this page to configure a single sign-on server (SSO) that is used for authenticating users. Starting from CSO Release 6.2.0, tenants can configure their own SSO server to authenticate their users.

There are two entities involved during the SSO configuration:

  • SSO Server or Identity Provider—An external server integrated with CSO.

  • OpCo or Tenant—Acts as an service provider and receives the SAML assertion sent by the SSO server in a response to a login request.

Both the identity provider and OpCo or tenant trust each other and configuration is required for both the entities. Two use cases are possible:

  • Identity provider is configured first before SSO server is added in CSO—The identity provider is configured first. Then, at the OpCo level, you can add the SSO server in CSO for tenant users, and enter the server name and metadata URL.

  • IdP is configured after SSO server is added in CSO—Enter the SSO server name and then click the Next button. CSO provides a list of URLs to be configured in the identity provider. After the identity provider is configured with the URLs, you can edit the SSO server name and enter the metadata URL.

Note:

For both the use cases, the metadata URL is required before you use the SSO server.

To configure an SSO server:

  1. Select Administration > Authentication.

    The Authentication page appears.

  2. Click the plus icon (+) in the Single Sign-On Server section.

    The Add Single Sign-On Server page appears.

  3. Complete the configuration according to the guidelines Table 1.
  4. Click OK to save the changes. If you want to discard the changes, click Cancel instead.
  5. After you configure both the SSO Server and CSO, click the Test Login button from the Authentication page.

    The SSO login page appears.

    Note:

    You must specify the metadata URL before you click the Test Login button. If you click the Test Login button without entering the metadata URL, an error message indicating that the metadata URL must be specified is displayed.

    To view the SAML settings, click the View SAML Settings button. See Table 2

Table 1: Fields on the Add Single Sign-On Server Page

Field

Description
Basic Information

SSO Server Name

Specify the name of the SSO server. You can use a string of alphanumeric characters, special characters such as the underscore (_) or the period (.), and spaces. The maximum length is 40 characters.

Description

Enter a meaningful description for the SSO server.

Metadata URL

Enter the URL from where the application metadata needs to be downloaded.

User Identification

Specify how a user is identified from the SAML assertion:

  • Name ID: The user is identified from the Name ID field that is present in the subject of the SAML assertion.

  • SAML attribute: The user is identified from the fixed value attribute.

    • SAML Attribute Name: Enter the name of the SAML attribute (such as username, e-mail, or any other parameter) that must be used for user identification. Do not use special characters. Ensure to use the same attribute name on the identity provider configuration.
Note:

If you are using Microsoft Azure as the IdP, we recommend that you use the SAML attribute for user identification. Tenant users might face authentication issues if you configure Name ID as the user identification attribute.

Table 2: SAML Settings
Field Description

SAML URLs

CSO displays the SAML URL settings. The administrator uses this information to configure the IdP.

Single Sign-On URL

Displays the SAML Assertion Consumer Service (ACS) URL for the application.

Example: https://aaa-example.com/ssol/sso server name/SAML2/POST

Audience URI (SP Entity ID)

Displays the service provider entity ID of the application.

Example: https://aaa-example.com/Shibboleth

Metadata URL

Displays the metadata URL of the application.

Example: https://aaa-example.com/saml/metadata/64000

Single Logout URL

Displays the single logout URL of the application.

Example: https://aaa-example.com/splogout

Download Metadata

Click this option to download metadata from the application.

The administrator can download the CSO metadata and use the metadata to configure the identity provider instead configuring individual identity provider fields at a time.

Download Certificate

 Click this option to download the SAML certificate from the application. The administrator can use this certificate to update the certificate on the identity provider.

Related Documentation