Smartstaff
1,385
edits
Changes
→User Creation Option (JIT Provisioning)
====Additional Settings====
* '''Bypass Two Factor Authentication''' - [[Multi-Factor Authentication|Bypass Two Factor Authentication]] when logged in with SSO
: '''Assertion Target URL''' - target site url
: '''Assertion Private Key''' - private key to establish connection with the target site.
=====User Creation Option(JIT Provisioning)=====
When users need to be created on the fly after SSO authentication, the following configuration settings are available:
* '''Default New Organization Status'''– assigned parent organization’s status for new organizations
'''<span style="color: #ff0000;">* <span style="color: #000000;">- mandatory fields when creating users thru SSO.</span></span>'''
[[File:SSO_UserCreation.png|thumb|none|500px|SSO User Creation Settings.]]
=====Optional Attibutes=====
The following optional attributes can be used in the assertion. Please note that they are case sensitive and should be labelled exactly.
* '''SSOModule''' - used to specify the SmartSimple SSO connection when there are multiple connections configured. i.e. "SAML2" for prod, "SSOBK" for backup instance, "SSODEV" for dev instance, "SSOTest" for test instance. Note that the attribute name and attribute value are case sensitive
* '''Email'''
* '''First name'''
* '''Last name'''
* '''Department''' - used to update the user's organization. This will attempt to match an organization by name and will move the user to that organization if found.
* '''Roles''' - used to update the user's roles in SmartSimple for new users. This should be a comma delimited list of SmartSimple user roles (by name) to be assigned to the user.
* '''Language''' - used to specify the initial language displayed to the user. This should be an integer value that corresponds with a language ID value in SmartSimple (e.g. 1=English).
=====Role Mapping=====
Additional settings to be configured is from the main login page ('''''Waffle''''' → '''''Global Settings''''' → '''''Branding''''' → '''''Login Pages''''') under the Single Sign-On section, select the MES Group Identifier from the dropdown list, and add button label i.e. ''Employee Login''.
====Optional AttibutesX.509 Certificate on the SP-Initiated SSO====The following optional attributes can be used in <!-- 148020 - Adding SP x509 signing certificate for SSO metadata and SSO authorization request -->In the assertionJuly 2023 upgrade, a new feature to support X. Please note that they are case sensitive and should be labelled exactly. * '''SSOModule''' 509 signing certificate for single sign- used to specify the SmartSimple on (SSO connection when there are multiple connections configured) authorization requests has been added.* '''Email'''* '''First name'''* '''Last name'''* '''Department''' If you are using a service provider- used to update initiated SSO, a signed authentication request embedded with the user's organization. This will attempt to match an organization by name signed value and will move the user to that organization if foundX.* '''Roles''' - used 509 certificate will be sent to update the user's roles in SmartSimple for new users. This should be a comma delimited list of SmartSimple user roles identity provider (by nameIdP) to be assigned to the user.* '''Language''' The new setting is located at Global Settings > Integrations tab > Single Sign-on > Edit a SP- used initiated SSO and toggle on Sign authentication request sent to specify the initial language displayed to the user. This should be an integer value that corresponds with a language ID value in SmartSimple identity provider (e.g. 1=EnglishIdP).
===Identity Provider Configuration - Client-Side System===
</md:ContactPerson>
</md:EntityDescriptor>
</pre>
====Active Directory Federation Services (ADFS)====
# URL Redirect
#* "User Access URL" for IdP-initiated SSO (Found under "''Properties''")
#* "Logon Login URL" for SP-initiated SSO (Found under ''Single Sign-on'' → ''Set up 'Application Name')''
====OKTA====
</samlp:AuthnRequest>
</pre></div>
==Adding URL Redirect in the Login Page==
From the [[Login Page]], the SSO URL redirect can be added to redirect internal users to the client's Identity Provider login page.
To configure, go to
1. Waffle → Global Settings → Branding → Login Pages
2. From the Login Pages listview, select the default login page to add the SSO URL redirect to.
3. Go to the Singe Sign-On section, select the MES Group Identifier and add the Link Label i.e. Employee Login
4. Click Save
Variables to use in a custom page layout:
* @ssodisplaylink@ - the variable to use to add the Link Label and hyperlink in the login template
* @ssotargetlink@ - the variable to use to retrieve the SSO login URL<br /> <br />
==Troubleshooting==
: This means that a corresponding active user was not found in the SmartSimple instance. Check the [Unique Identifier Field] that is configured in the SSO setting, and then compare the value of the "NameID" node sent within the SAML assertion to see if a user with that field value exists in SmartSimple. Check that the user is activated and allows login.
* '''SAML failed. Login session is nullnull / Invalid SAML Response'''
: Check that a matching user account exist
==Example of SSO configuration in SmartSimple==
===Configuration for SSO in production instance===
'''A. SSO Configuration'''
: '''Bypass Multi-Factor Authentication (MFA)''': enabled
4. Click Save
'''B. Login Page Configuration'''
: '''Link Label''': '''''Employee Login''''' (open text field)
4. Click Save
Upon logout, the SSO button will be visible below the the username/password.
If client has 4 environments (Prod, Backup, Dev, Test), settings above will be created one for each environment.
Note that these settings will need to be copied over to different instances so as when T2P occurs, all settings are existing and copied over to different environmentsand no editing is necessary after T2P.
{| class="wikitable"
