Single Sign-On (SSO) - Revision history

IVSWikiBlue at 20:06, 8 April 2025

2025-04-08T20:06:16Z

← Older revision		Revision as of 20:06, 8 April 2025
Line 42:		Line 42:
	<dt>User Mapping</dt>		<dt>User Mapping</dt>
	<dd class="singleLineHeight">VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:		<dd class="singleLineHeight">VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:
			<ul>
	<b>Unique User Identifier</b> - This attribute will be used as the username		<li><strong>Unique User Identifier</strong> - This attribute will be used as the username.</li>
			<li><strong>Groups</strong> - This attribute will be used to define which group the user is assigned to within VALT. In addition to the name of the Group attribute, VALT will need the value associated with each group that will be logging into VALT.</li>
	<b>Groups</b> - This attribute will be used to define which group the user is assigned to within VALT. In addition to the name of the Group attribute, VALT will need the value associated with each group that will be logging into VALT		<li><strong>Display Name</strong> - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user.</li>
			</ul></dd>
	<b>Display Name</b> - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user</dd>
	</dl>		</dl>

IVSWikiBlue at 20:01, 8 April 2025

2025-04-08T20:01:52Z

← Older revision		Revision as of 20:01, 8 April 2025
Line 24:		Line 24:
	{{hr - 2}}		{{hr - 2}}

	{{img - resize \| file = SSO Flow Chart.png}}		{{Section - Expand \| title = Image Example \| color = #f6c62a \| content = {{img - resize \| file = SSO Flow Chart.png}} }}

	{{hr}}		{{hr}}

IVSWikiBlue at 20:00, 8 April 2025

2025-04-08T20:00:35Z

← Older revision		Revision as of 20:00, 8 April 2025
Line 17:		Line 17:

	*VALT's SSO uses <b>Just-In-Time (JIT) Provisioning</b>.		*VALT's SSO uses <b>Just-In-Time (JIT) Provisioning</b>.
	**<em>Users are reevaluated and assigned to groups each time they log in, based on a ~~[[Single_Sign-On_(SSO)#User_Mapping \|~~ group membership]] attribute being passed.</em>		**<em>Users are reevaluated and assigned to groups each time they log in, based on a group membership attribute being passed.</em>
	*If a user does <u>NOT</u> have a user mapping associated with their account, the user gets moved to "<b>Users without Group</b>" and has restricted access.		*If a user does <u>NOT</u> have a user mapping associated with their account, the user gets moved to "<b>Users without Group</b>" and has restricted access.
	*If a user's user mapping changes, they will be moved to the correct group upon their next SSO sign-in.		*If a user's user mapping changes, they will be moved to the correct group upon their next SSO sign-in.

IVSWikiBlue at 19:58, 8 April 2025

2025-04-08T19:58:08Z

← Older revision		Revision as of 19:58, 8 April 2025
Line 31:		Line 31:
	{{:VALT SSO - VALT's Metadata File}}		{{:VALT SSO - VALT's Metadata File}}


			{{Top of Page}}
	{{hr}}		{{hr}}

Line 48:		Line 50:
	</dl>		</dl>


			{{Top of Page}}
	{{hr}}		{{hr}}

	{{Manual lvl 2 \| title = Optional Items \| content =		{{Manual lvl 2 \| title = Optional Items \| content =
	VALT is also able to map custom attributes to some of the following fields for a user. Below are the user account fields that can be assigned through SSO.		VALT is also able to map custom attributes to some of the following fields for a user. Below are the user account fields that can be assigned through SSO.

	{{hr - 2}}		{{hr - 2}}

Line 67:		Line 72:
	}}		}}


			{{Top of Page}}
	{{hr}}		{{hr}}

IVSWikiBlue at 19:56, 8 April 2025

2025-04-08T19:56:09Z

← Older revision		Revision as of 19:56, 8 April 2025
Line 1:		Line 1:
	~~__NOTOC__~~		{{Article - Manual \| title = SSO Configuration \| content =
	{{Article \| title = SSO Configuration \| content =		[[VALT SSO\| ⤺ Back to VALT SSO Main Page]]
	{{Aside - Helpful \| content = VALT is compatible with <b>SAML 2.0</b>.}}		{{Aside - Helpful \| content = VALT is compatible with <b>SAML 2.0</b>.}}
	{{Aside \| content = To access SSO on your system, you may need to reach out to our support team. [https://ivs.help IVS Support]}}		{{Aside \| content = To access SSO on your system, you may need to reach out to our support team. [https://ivs.help IVS Support]}}
Line 6:		Line 6:
	{{hr}}		{{hr}}

	==Scheduling ~~an SSO~~ Configuration==		<h1>Scheduling a Configuration</h1>
	{{Aside - Warning \| hue = 50 \| content = Before configuring SSO in VALT, please make sure you've completed our [[SSO Check List]].}}		{{Aside - Warning \| hue = 50 \| content = Before configuring SSO in VALT, please make sure you've completed our [[SSO Check List]].}}

Line 13:		Line 13:
	{{hr}}		{{hr}}

	<h2>~~SSO~~ Authentication</h2>		<h1>Authentication</h1>
	SSO accounts are automatically created when a user logs in for the first time. The user can be placed in the proper group automatically upon login by mapping SSO attributes to a user group within VALT.		SSO accounts are automatically created when a user logs in for the first time. The user can be placed in the proper group automatically upon login by mapping SSO attributes to a user group within VALT.

Line 28:		Line 28:
	{{hr}}		{{hr}}

	==Metadata Files==		<h1>Metadata Files</h1>
	{{:VALT SSO - VALT's Metadata File}}		{{:VALT SSO - VALT's Metadata File}}

	{{hr}}		{{hr}}

	==Required Information ~~from~~ IdP==		<h1>Required Information (IdP)</h1>
			<dl>
	<dt>IdP Metadata File</dt>		<dt>IdP Metadata File</dt>
	<dd class="singleLineHeight">To integrate your IdP with VALT, the metadata files from both will need to be exchanged. The VALT metadata file will be generated after the IdP metadata file is uploaded to VALT.</dd>		<dd class="singleLineHeight">To integrate your IdP with VALT, the metadata files from both will need to be exchanged. The VALT metadata file will be generated after the IdP metadata file is uploaded to VALT.</dd>
			{{hr - 2}}
	<dt>User Mapping</dt>		<dt>User Mapping</dt>
	<dd class="singleLineHeight">VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:		<dd class="singleLineHeight">VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:
Line 44:		Line 46:

	<b>Display Name</b> - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user</dd>		<b>Display Name</b> - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user</dd>
	{{hr ~~- 2~~}}		</dl>

			{{hr}}

	~~<h3>~~Optional Items~~</h3>~~		{{Manual lvl 2 \| title = Optional Items \| content =
	VALT is also able to map custom attributes to some of the following fields for a user. Below are the user account fields that can be assigned through SSO.		VALT is also able to map custom attributes to some of the following fields for a user. Below are the user account fields that can be assigned through SSO.
	{{hr - 2}}		{{hr - 2}}
Line 61:		Line 65:
	<dd class="singleLineHeight"><em>If the VALT application is not connected to mail server, this field is not used for anything.</em></dd>		<dd class="singleLineHeight"><em>If the VALT application is not connected to mail server, this field is not used for anything.</em></dd>
	</dl>		</dl>
			}}

	{{hr}}		{{hr}}

	<h2>Additional Settings</h2>		<h1>Additional Settings</h1>
	Shibboleth needs the following settings configured to function with VALT.		Shibboleth needs the following settings configured to function with VALT.

	~~{{hr~~ - ~~2}}~~		<table class="wikitable">
			<tr>
			<th style="text-align:right;padding:0px 5px 0px 20px">signAssertions</th>
			<td style="padding:0px 40px">true</td>
			</tr>
			<tr>
			<th style="text-align:right;padding:0px 5px 0px 20px">signResponses</th>
			<td style="padding:0px 40px">true</td>
			</tr>
			<tr>
			<th style="text-align:right;padding:0px 5px 0px 20px">encryptNameIDs</th>
			<td style="padding:0px 40px">true</td>
			</tr>
			<tr>
			<th style="text-align:right;padding:0px 5px 0px 20px">encryptAssertions</th>
			<td style="padding:0px 40px">false</td>
			</tr>
			</table>

	~~<dl>~~
	~~<dt>signAssertions:</dt>~~
	~~<dd class="singleLineHeight">true</dd>~~
	~~<dt>signResponses:<dt>~~
	~~<dd class="singleLineHeight">true</dd>~~
	~~<dt>encryptNameIDs:</dt>~~
	~~<dd class="singleLineHeight">true</dd>~~
	~~<dt>encryptAssertions:</dt>~~
	~~<dd class="singleLineHeight">false</dd>~~
	~~</dl>~~

	~~{{hr}}~~

	~~[[VALT SSO\| ⤺ Back to VALT SSO Main~~ Page]]		{{Top of Page}}
	}}		}}

IVSWikiBlue at 16:23, 7 March 2025

2025-03-07T16:23:53Z

← Older revision		Revision as of 16:23, 7 March 2025
Line 52:		Line 52:
	<dl>		<dl>
	<dt>PIN</dt>		<dt>PIN</dt>
	<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>		<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM Main Page\|BEAM]].</dd>
	<dd class="singleLineHeight"><em>Without one set, no pin is needed to enter BEAM</em>.</dd>		<dd class="singleLineHeight"><em>Without one set, no pin is needed to enter BEAM</em>.</dd>
	<dt>Card Number</dt>		<dt>Card Number</dt>

IVSWikiBlue at 22:40, 2 January 2025

2025-01-02T22:40:42Z

← Older revision		Revision as of 22:40, 2 January 2025
Line 25:		Line 25:

	{{img - resize \| file = SSO Flow Chart.png}}		{{img - resize \| file = SSO Flow Chart.png}}

			{{hr}}

			==Metadata Files==
			{{:VALT SSO - VALT's Metadata File}}

	{{hr}}		{{hr}}

IVSWikiBlue at 17:57, 22 November 2024

2024-11-22T17:57:44Z

← Older revision		Revision as of 17:57, 22 November 2024
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
	{{Article \| title = SSO Configuration \| content =		{{Article \| title = SSO Configuration \| content =
	{{Aside - ~~Warning \| hue = 50~~ \| content = VALT is compatible with <b>SAML 2.0</b>.}}		{{Aside - Helpful \| content = VALT is compatible with <b>SAML 2.0</b>.}}
	{{Aside \| content = To access SSO on your system, you may need to reach out to our support team. [https://ivs.help IVS Support]}}		{{Aside \| content = To access SSO on your system, you may need to reach out to our support team. [https://ivs.help IVS Support]}}

	{{hr}}		{{hr}}

	==~~The Basics~~==		==Scheduling an SSO Configuration==
	Before configuring SSO in VALT, please make sure you've completed our [[SSO Check List]].		{{Aside - Warning \| hue = 50 \| content = Before configuring SSO in VALT, please make sure you've completed our [[SSO Check List]].}}

	You can also schedule a <b>SSO Discovery</b> at our [https://ivs.help booking site] under <b>Schedule a Support Session</b>. ~~There~~, we will discuss the prerequisites for configuring your VALT server to utilize SSO Authentication.		You can also schedule a <b>SSO Discovery</b> at our [https://ivs.help booking site] under <b>Schedule a Support Session</b>. During that call, we will discuss the prerequisites for configuring your VALT server to utilize SSO Authentication.

	{{hr}}		{{hr}}

	~~==Required Information from IdP==~~		<h2>SSO Authentication</h2>
	~~{{Aside - Helpful \| content = As of VALT 6, the metadata file from the IdP will be required for configuring SSO.}}~~		SSO accounts are automatically created when a user logs in for the first time. The user can be placed in the proper group automatically upon login by mapping SSO attributes to a user group within VALT.
	<dl>
	~~<dt>Account Name Attribute~~</dt>		*VALT's SSO uses <b>Just-In-Time (JIT) Provisioning</b>.
	~~<dd class="singleLineHeight">This refers to the attribute that the IdP will send VALT~~ for the ~~account username~~.~~</dd>~~		**<em>Users are reevaluated and assigned to groups each time they log in, based on a [[Single_Sign-On_(SSO)#User_Mapping \| group membership]] attribute being passed.</em>
	~~<dd class="singleLineHeight"><em>This must~~ be a ~~unique identitfier~~.~~</em></dd>~~		*If a user does <u>NOT</u> have a user mapping associated with their account, the user gets moved to "<b>Users without Group</b>" and has restricted access.
	~~{{Aside - Warning \| hue = 50 \| content = If users already have accounts in~~ VALT~~, please ensure the IdP can pass an attribute that matches the existing username.}}~~		*If a user's user mapping changes, they will be moved to the correct group upon their next SSO sign-in.
	<dt>~~Identity Provider~~ (~~IdP~~) ~~URL~~</dt>		**<em>Correct mapping is based on the SSO mapping created in VALT and the attribute/pair value being passed from the IdP.</em>
	<~~dd class="singleLineHeight"~~>~~This refers~~ to ~~the service or application that manages and authenticates user identities~~, ~~which VALT will use to verify login credentials~~.</dd>
	<dt>~~Remote Sign-In URL~~</dt>		{{hr - 2}}
	~~<dd class="singleLineHeight">This is~~ the ~~URL provided by the IdP where users are redirected~~ to ~~initiate the login process.~~<~~/dd~~>
	~~<dt>Remote Sign-Out URL~~</dt>		{{img - resize \| file = SSO Flow Chart.png}}
	~~<dd class="singleLineHeight">This URL leads to the IdP~~'s ~~logout page~~, ~~where users can safely end~~ their ~~sessions, ensuring a secure~~ sign-~~out process from VALT~~.~~</dd>~~
	<dt>~~Certificate~~ in ~~.cer format<~~/~~dt>~~
	~~<dd class="singleLineHeight">VALT requires a digital certificate in .cer format~~ from the IdP ~~to establish a secure, encrypted communication channel~~.</dd>
	~~</dl>~~

	{{hr}}		{{hr}}

	<h2>~~User Mapping~~</h2>		==Required Information from IdP==
	~~User mapping is used to map users~~ to ~~groups~~. ~~This mapping is done through the attributes and values being passed from~~ the IdP. VALT's SSO uses a ~~<b>~~1:1 mapping~~</b> for~~ groups.		<dt>IdP Metadata File</dt>
			<dd class="singleLineHeight">To integrate your IdP with VALT, the metadata files from both will need to be exchanged. The VALT metadata file will be generated after the IdP metadata file is uploaded to VALT.</dd>
			<dt>User Mapping</dt>
			<dd class="singleLineHeight">VALT's SSO uses a 1:1 mapping to add users to the correct groups. To achieve this, we require the following attributes:

	~~{{hr~~ - ~~2}}~~		<b>Unique User Identifier</b> - This attribute will be used as the username

	<h3>~~Required~~</h3>		<b>Groups</b> - This attribute will be used to define which group the user is assigned to within VALT. In addition to the name of the Group attribute, VALT will need the value associated with each group that will be logging into VALT
	~~<dl>~~
	~~<dt>Name</dt>~~
	~~<dd class="singleLineHeight">Arbitrary descriptive name for~~ the ~~mapping rule.</dd>~~
	~~<dd><em>Used only in this section of~~ VALT.~~</em></dd>~~
	~~<dt>Attribute</dt>~~
	~~<dd class="singleLineHeight">FriendyName~~ of the attribute ~~being sent from~~ the ~~IdP for group information.</dd>~~
	~~<dt>User Value<dt>~~
	~~<dd class="singleLineHeight">The~~ value ~~of the attribute that we will use to map users to a particular group.</dd>~~
	~~<dt>Group to Add</dt>~~
	~~<dd class="singleLineHeight">The VALT~~ group that ~~the user~~ will be ~~placed in when there is a match for the "User Value" field.</dd>~~
	~~</dl>~~

	{{hr}}		<b>Display Name</b> - If the Unique User identifier does not correspond with the person's name, this attribute will set an easy-to-identify display name for the user</dd>
			{{hr - 2}}

	<h3>Optional Items</h3>		<h3>Optional Items</h3>
Line 57:		Line 46:

	<dl>		<dl>
	~~<dt>Display Name Attribute</dt>~~
	~~<dd class="singleLineHeight">This specifies the user attribute (such as username or email) that VALT displays within the application.</dd>~~
	~~<dd class="singleLineHeight"><em>Helpful when people are not easy to recognize by the username field</em>.</dd>~~
	<dt>PIN</dt>		<dt>PIN</dt>
	<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>		<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>

IVSWikiBlue at 16:48, 6 November 2024

2024-11-06T16:48:32Z

← Older revision		Revision as of 16:48, 6 November 2024
Line 16:		Line 16:
	{{Aside - Helpful \| content = As of VALT 6, the metadata file from the IdP will be required for configuring SSO.}}		{{Aside - Helpful \| content = As of VALT 6, the metadata file from the IdP will be required for configuring SSO.}}
	<dl>		<dl>
			<dt>Account Name Attribute</dt>
			<dd class="singleLineHeight">This refers to the attribute that the IdP will send VALT for the account username.</dd>
			<dd class="singleLineHeight"><em>This must be a unique identitfier.</em></dd>
			{{Aside - Warning \| hue = 50 \| content = If users already have accounts in VALT, please ensure the IdP can pass an attribute that matches the existing username.}}
	<dt>Identity Provider (IdP) URL</dt>		<dt>Identity Provider (IdP) URL</dt>
	<dd class="singleLineHeight">This refers to the service or application that manages and authenticates user identities, which VALT will use to verify login credentials.</dd>		<dd class="singleLineHeight">This refers to the service or application that manages and authenticates user identities, which VALT will use to verify login credentials.</dd>

IVSWikiBlue at 16:50, 8 May 2024

2024-05-08T16:50:11Z

← Older revision		Revision as of 16:50, 8 May 2024
Line 56:		Line 56:
	<dd class="singleLineHeight">This specifies the user attribute (such as username or email) that VALT displays within the application.</dd>		<dd class="singleLineHeight">This specifies the user attribute (such as username or email) that VALT displays within the application.</dd>
	<dd class="singleLineHeight"><em>Helpful when people are not easy to recognize by the username field</em>.</dd>		<dd class="singleLineHeight"><em>Helpful when people are not easy to recognize by the username field</em>.</dd>
	<dt>~~Pin Code~~</dt>		<dt>PIN</dt>
	<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>		<dd class="singleLineHeight">This specifies the code used for authentication into [[BEAM]].</dd>
	<dd class="singleLineHeight"><em>Without one set, no pin is needed to enter BEAM</em>.</dd>		<dd class="singleLineHeight"><em>Without one set, no pin is needed to enter BEAM</em>.</dd>