Difference between revisions of "Template:VALT 6 SSO Configuration"

From IVS Wiki
Jump to: navigation, search
(Created page with "__NOTOC__ {{Article | title = SSO Configuration | content = {{Aside - Warning | hue = 50 | content = VALT is compatible with <b>SAML 2.0</b>.}} {{Aside | content = To access...")
 
Line 6: Line 6:
 
{{hr}}
 
{{hr}}
  
−
==The Basics==
+
==Scheduling an SSO Configuration==
 
Before configuring SSO in VALT, please make sure you've completed our [[SSO Check List]].
 
Before configuring SSO in VALT, please make sure you've completed our [[SSO Check List]].
  
−
You can also schedule a <b>SSO Discovery</b> at our [https://ivs.help booking site] under <b>Schedule a Support Session</b>. There, we will discuss the prerequisites for configuring your VALT server to utilize SSO Authentication.
+
You can also schedule a <b>SSO Discovery</b> at our [https://ivs.help booking site] under <b>Schedule a Support Session</b>. During that call, we will discuss the prerequisites for configuring your VALT server to utilize SSO Authentication.
  
 
{{hr}}
 
{{hr}}
  
 
==Required Information from IdP==
 
==Required Information from IdP==
−
{{Aside - Helpful | content = As of VALT 6, the metadata file from the IdP will be required for configuring SSO.}}
+
<dt>IdP Metadata File</dt>  
−
<dl>
+
<dd class="singleLineHeight">To integrate your IdP with VALT, the metadata files from both will need to be exchanged. The VALT metadata file will be generated after the IdP metadata file is uploaded to VALT.</dd>
−
<dt>Account Name Attribute</dt>
+
<dt>User Mapping</dt>  
−
<dd class="singleLineHeight">This refers to the attribute that the IdP will send VALT for the account username.</dd>
+
<dd class="singleLineHeight">VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:
−
<dd class="singleLineHeight"><em>This must be a unique identitfier.</em></dd>
 
−
{{Aside - Warning | hue = 50 | content = If users already have accounts in VALT, please ensure the IdP can pass an attribute that matches the existing username.}}
 
−
<dt>Identity Provider (IdP) URL</dt>
 
−
<dd class="singleLineHeight">This refers to the service or application that manages and authenticates user identities, which VALT will use to verify login credentials.</dd>
 
−
<dt>Remote Sign-In URL</dt>
 
−
<dd class="singleLineHeight">This is the URL provided by the IdP where users are redirected to initiate the login process.</dd>
 
−
<dt>Remote Sign-Out URL</dt>
 
−
<dd class="singleLineHeight">This URL leads to the IdP's logout page, where users can safely end their sessions, ensuring a secure sign-out process from VALT.</dd>
 
−
<dt>Certificate in .cer format</dt>
 
−
<dd class="singleLineHeight">VALT requires a digital certificate in .cer format from the IdP to establish a secure, encrypted communication channel.</dd>
 
−
</dl>
 
  
−
{{hr}}
+
<b>Unique User Identifier</b> - This attribute will be used as the username
  
−
<h2>User Mapping</h2>
+
<b>Groups</b> - This attribute will be used to define which group the user is assigned to within VALT. In addition to the name of the Group attribute, VALT will need the value associated with each group that will be logging into VALT
−
User mapping is used to map users to groups. This mapping is done through the attributes and values being passed from the IdP. VALT's SSO uses a <b>1:1 mapping</b> for groups.
 
  
 +
<b>Display Name</b> - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user</dd>
 
{{hr - 2}}
 
{{hr - 2}}
−
 
−
<h3>Required</h3>
 
−
<dl>
 
−
<dt>Name</dt>
 
−
<dd class="singleLineHeight">Arbitrary descriptive name for the mapping rule.</dd>
 
−
<dd><em>Used only in this section of VALT.</em></dd>
 
−
<dt>Attribute</dt>
 
−
<dd class="singleLineHeight">FriendyName of the attribute being sent from the IdP for group information.</dd>
 
−
<dt>User Value<dt>
 
−
<dd class="singleLineHeight">The value of the attribute that we will use to map users to a particular group.</dd>
 
−
<dt>Group to Add</dt>
 
−
<dd class="singleLineHeight">The VALT group that the user will be placed in when there is a match for the "User Value" field.</dd>
 
−
</dl>
 
−
 
−
{{hr}}
 
  
 
<h3>Optional Items</h3>
 
<h3>Optional Items</h3>
Line 57: Line 31:
  
 
<dl>
 
<dl>
−
<dt>Display Name Attribute</dt>
 
−
<dd class="singleLineHeight">This specifies the user attribute (such as username or email) that VALT displays within the application.</dd>
 
−
<dd class="singleLineHeight"><em>Helpful when people are not easy to recognize by the username field</em>.</dd>
 
 
<dt>PIN</dt>
 
<dt>PIN</dt>
 
<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>
 
<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>

Revision as of 11:38, 22 November 2024

SSO Configuration

⚠VALT is compatible with SAML 2.0.

✎To access SSO on your system, you may need to reach out to our support team. IVS Support

Scheduling an SSO Configuration

Before configuring SSO in VALT, please make sure you've completed our SSO Check List.

You can also schedule a SSO Discovery at our booking site under Schedule a Support Session. During that call, we will discuss the prerequisites for configuring your VALT server to utilize SSO Authentication.

Required Information from IdP

IdP Metadata File
To integrate your IdP with VALT, the metadata files from both will need to be exchanged. The VALT metadata file will be generated after the IdP metadata file is uploaded to VALT.
User Mapping
VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:

Unique User Identifier - This attribute will be used as the username

Groups - This attribute will be used to define which group the user is assigned to within VALT. In addition to the name of the Group attribute, VALT will need the value associated with each group that will be logging into VALT

Display Name - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user

Optional Items

VALT is also able to map custom attributes to some of the following fields for a user. Below are the user account fields that can be assigned through SSO.

PIN
This specifies the code used for authentication into BEAM.
Without one set, no pin is needed to enter BEAM.
Card Number
This specifies the card number associated with a user.
Only applies to customers with VALT Card Reader.
Email
The users email can also be pulled into the system.
If the VALT application is not connected to mail server, this field is not used for anything.

Additional Settings

Shibboleth needs the following settings configured to function with VALT.

signAssertions:
true
signResponses:
true
encryptNameIDs:
true
encryptAssertions:
false
⤺ Back to VALT SSO Main Page
Retrieved from "https://ipivs.info/wiki/index.php?title=Template:VALT_6_SSO_Configuration&oldid=13618"