Third-party IdP SSO integration

NAVIGATION  Header > Admin Settings > Single Sign-On

PERMISSIONS  Admin role

NOTE  Before running this procedure, you must create and configure the KaseyaOne SSO application in the third-party IdP. For details, see Setting up a third-party IdP SSO integration for KaseyaOne.

To configure SSO in KaseyaOne for a third-party IdP:

1. Navigate to the Single Sign-On page. Refer to Security and navigation.
2. In the Single Sign-On with Identity Providers section, click Add configuration.
   
3.  Enter the following information:

• Identity Provider Single Sign-On URL: Enter the third-party IdP SSO URL in this field.
• Identify Provider Issuer: Enter the third-party IdP issuer in this field.

4. Click Upload Certificate to upload the third-party IdP certificate. Enter the Certificate Information.
5. Click Save.
   
6. In the Single Sign-On with Identify Providers section, turn on the Enable Single Sign-On via SAML toggle to enable SSO via SAML for the IdP.
7. Click Save. You will see a check mark and the word Configured after successfully configuring SSO.
   

   NOTE  Secure Assertion Markup Language (SAML) provides a way to authenticate users once and then communicate that authentication to multiple other applications.

8. Configure one or more of the following Advanced Single Sign-On Settings as required:

• Enforce Log In with SSO to force users to log in with their SSO application. Refer to Configure Enforce Log In with SSO in KaseyaOne.
• Enable Automatic User Creation to allow just-in-time (JIT) user provisioning for the SSO application. Refer to Configure Enable Automatic User Creation for a third-party IdP SSO in KaseyaOne.
• IdP Groups Access Control to control access to KaseyaOne using your IdP group user assignments. Refer to Configure third-party IdP Groups Access Control in KaseyaOne.

IMPORTANT  Advanced Single Sign-On Settings cannot be enabled until Enable Single Sign-On via SAML is configured and enabled.

NOTE  Currently, only one third-party IdP integration can be active in KaseyaOne.

A valid certificate is needed for SSO functionality between KaseyaOne and your third-party IdP. SSO certificates typically expire in two years. To prevent login disruptions, you must upload a new certificate before your existing certificate expires.

When will my certificate expire?

KaseyaOne notifies all Admin users when an SSO certificate is nearing expiration: at 60 days before expiration, 30 days before expiration, seven days before expiration, on expiration day, and one day after expiration. These notifications display in the KaseyaOne UI and are also emailed to Admin users. Notifications cease once a new, valid certificate has been uploaded. Example notifications are shown here:

You can also check the certificate's expiration date by viewing your third-party IdP's configuration from the Single Sign-On page.

To upload a new certificate

1. Navigate to the Single Sign-On page. Refer to Security and navigation.
2. In the Single Sign-On with Identity Providers section, click Edit configuration.
   
3.  In the Configure SSO pane, click Upload Certificate, browse to select the new certificate, then click Open to upload.
   
4. You see a Certificate uploaded successfully message and details of the new certificate display in the Configure SSO pane. All certificate expiration notifications are removed from the KaseyaOne UI.

You can configure Enforce Log In with SSO functionality as shown in the following procedure to require users to log in to KaseyaOne with their SSO application.

NOTE  You must have SSO to enable this function. Configure the SSO connection and settings for the IdP and toggle on Enable Single Sign-On via SAML in KaseyaOne. Refer to Setting up a third-party IdP SSO integration for KaseyaOne.

1. Navigate to the Single Sign-On page. Refer to Security and navigation.

2. In the Advanced Single Sign-On Settings section, turn on the Enforce Log In with SSO toggle to enable the feature.

• If enabled, users are forced to log in to KaseyaOne with their SSO application (and prompted to do so).
• If disabled, users are allowed to log in to KaseyaOne using either their SSO application or local authentication.

3. From the User Exceptions drop-down menu, select one or more users who will be exempt from the Enforce Log In with SSO condition, if enabled.

You can configure Enable Automatic User Creation as shown in the following procedure to enable just-in-time provisioning (JIT) for the SSO application. SAML SSO users will then be provisioned on a just-in-time basis with a specified default role when they authenticate for the first time.

JIT provisioning increases efficiency and productivity, saves time and resources, and reduces administrative costs. It allows new users to access a web application in real-time, eliminating the need for manual account setup.

The prerequisites to using JIT provisioning for third-party IdP SSO are:

• You must have SSO to enable this function. Configure the SSO connection and settings for the IdP and toggle on Enable Single Sign-On via SAML in KaseyaOne. Refer to Setting up a third-party IdP SSO integration for KaseyaOne.

• Preconfigure the user role and groups before turning on this feature.

To configure Enable Automatic User Creation for third-party IdP SSO in KaseyaOne:

1. Navigate to the Single Sign-On page. Refer to Security and navigation.
2. In the Advanced Single Sign-On Settings section, turn on the Enable Automatic User Creation toggle to enable the feature.

• If enabled, user accounts are automatically created with the specified default role when users authenticate for the first time
• If disabled, users must ask their administrator to create a user account for them with the required role after they authenticate.
  

3. In the Default Role field, click the drop-down arrow and select one role to assign to auto-provisioned users. You can select Admin, Billing and Purchasing, User, or Co-Managed User.
4. In the Default Groups field, click the drop-down arrow and select one or more group(s) where auto-provisioned users will be assigned.
5. Changes are automatically saved.

IdP Groups Access Control provides automatic correct user permission assignments based on IdP groups. This streamlines user management and reduces the time spent on it. IdP Groups Access Control ensures that the correct permissions are automatically assigned to the users that are coming from IdP based on their IdP group memberships.

You can configure role-based access control (RBAC) for third-party IdP SSO users in KaseyaOne. This involves defining mapping rules to control user access for SSO users and then enabling the IdP Groups Access Control feature. The purpose of defining mapping rules is to mimic or maintain the same levels of user access defined in the third-party IdP and port them over to KaseyaOne.

The prerequisites and considerations for configuring IdP Groups Access Control are:

• You must have SSO to enable this function. Configure the SSO connection and settings for the IdP and toggle on Enable Single Sign-On via SAML in KaseyaOne. Refer to Setting up a third-party IdP SSO integration for KaseyaOne.
• While configuring IdP Groups Access Control, you will map each IdP group to a KaseyaOne user role and group(s). Preconfigure the KaseyaOne user roles and groups you will use before you configure this feature. Refer to User roles and Managing KaseyaOne groups.
• Ensure that all existing KaseyaOne users are assigned to an IdP group. While configuring this feature, be sure to map the IdP group of each existing KaseyaOne user. Once you turn on this feature, any existing KaseyaOne user account that does not belong to an IdP group or whose IdP group is not defined in the mapping rules is deactivated and revoked access to KaseyaOne.

To configure IdP Groups Access Control for third-party IdP SSO in KaseyaOne:

1. Navigate to the Single Sign-On page. Refer to Security and navigation.
2. In the Mapping Rules section, select either Stop at first match or Process all rules.
   
3. Click Add Rule.
   
4. In the IdP Group Name field, enter the exact name of the third-party IdP user Group Name. IdP group names are case-sensitive.
   

IMPORTANT  If a KaseyaOne user does not belong to an IdP group or the IdP group is not defined in the Mapping Rules, that user's KaseyaOne account will be deactivated and revoked access to KaseyaOne.

5. Select one KaseyaOne Role from the drop-down list. You can map an IdP group to more than one KaseyaOne Role.
6. Select a KaseyaOne Group from the dropdown list. You can select more than one KaseyaOne Group.
7. (Optional) Type in a description of the mapping rule in the Mapping Description field.
8. Hover over the mapping rule and drag to reorder.
9. Turn on the IdP Groups Access Control toggle to enable the RBAC feature for SSO users.
   
10. Click the Save check mark.