How do I set up SSO?

SoftwareOne Marketplace has an SSO Authentication framework that integrates with existing identity provider tools, such as Azure AD and ADFS, and SAML-based tools, such as Okta and Ping. This topic describes how you can set up SSO with these tools.

Setting up SSO with SAML

Process

Setting up SSO with SAML involves the following steps:

1. Provide IdP metadata to SoftwareOne - Provide SoftwareOne with basic metadata about your IdP. If your SSO tool requires the Assertion Consumer Service URL and Entity ID, contact SoftwareOne.

2. SoftwareOne configures the client portal for your connection - SoftwareOne proceeds with a basic setup on the Client Portal IdP and provides you with {connection_name} to use for further configuration.

3. You complete your IdP configuration - Finalize the setup on your side.

4. Federation becomes active - All logins to the Client Portal for any of the specified IdP domains are federated out to your SAML-based IdP.

To set up SSO with SAML, SoftwareOne requires the following information:

• IdP Domains (list of email domains, for example, @user.org for which authentication should be federated out to your IdP)

• Sign In URL (HTTP-POST or HTTP-Redirect)

• Sign out URL

The {connection_name} is a verbatim string that SoftwareOne provides after receiving your initial configuration settings.

The Client Portal requires the following attributes via specified mappings:

The attributes must satisfy at least one mapping for all properties above. If your IdP provides values for the required attributes in different claims/namespaces, provide a list of claims to be used for all attributes above.

Make sure to provide the attribute values as they are without any modifications. URLs are sometimes changed by security software, for example, Proofpoint’s Targeted Attack Protection adds urldefense.com at the beginning of links.

To set up SSO with the Client Portal via Azure AD, you must complete the following steps. Once these steps are completed, SoftwareOne will enable SSO with your Azure AD.

Setting up SSO with Azure AD involves the following steps:

The Client Portal queries the following basic profile attributes from Azure AD:

• upn

• azure_id

• given_name

Setting up SSO with ADFS involves the following steps:

1. Configure your ADFS server according to technical requirements.

2. Provide ADFS metadata and IdP domains to SoftwareOne.

3. SoftwareOne completes the ADFS setup.

To set up SSO with ADFS, SoftwareOne requires the following information:

• ADFS Metadata Source (either the URL or the Federation Metadata file. The URL usually ends in /FederationMetadata/2007-06/FederationMetadata.xml )

• IdP Domains (list of all email domains that must be authenticated through the federated ADFS server, for example, @customer.com. Usually 1 domain, but can also be multiple.)

By default, the Client Portal expects the following attributes from ADFS via the specified mappings:

Setting up SSO with PingFederate involves the following steps:

1. Provide sign-in certificates/IdP domains to SoftwareOne.

2. SoftwareOne completes the SSO setup.

To set up SSO with PingFederate, SoftwareOne requires the following information:

• PingFederate Server URL.

• X509 signing certificate in the .pem or .cer format.

• IdP Domains, including a list of all email domains that should be authenticated through the federated ADFS server (for example, @customer.com). Usually just one, but can also be multiple.

By default, the Client Portal requires the following attributes via the specified mappings:

The provided attributes must satisfy at least one mapping for all properties above. If your IdP provides values for the required attributes in different claims/namespaces, you can provide a list of claims to be used for all attributes above.

If an email domain is federated out to the user's identity provider, the Client Portal receives sign-in attempts from users who are not set up as Client Portal users.

In such cases, if authenticated users from a federated connection are not Client Portal users, their login to Client Portal will fail with an error message stating that their account is not set up and they don't have access.