| Line 9: | Line 9: | ||
1. Click “Configure” tile and click “System Configuration”. The “System Configuration – Self-Service” tab will open. | 1. Click “Configure” tile and click “System Configuration”. The “System Configuration – Self-Service” tab will open. | ||
| − | <div class="image-green-border">[[File:E sign 8.2 1.png|250px|E sign 8.2 1.png]]</div> <div class="image-green-border"> </div> <div class="image-green-border">2. Click “SSO Configuration”. The “SSO Configuration” page will open.</div> <div class="image-green-border"> </div> <div class="image-green-border">[[File:SSO Config 8.2 1.png|720px|SSO Config 8.2 1.png]]</div> <div class="image-green-border"> </div> <div class="image-green-border"> | + | <div class="image-green-border">[[File:E sign 8.2 1.png|250px|E sign 8.2 1.png]]</div> <div class="image-green-border"> </div> <div class="image-green-border">2. Click “SSO Configuration”. The “SSO Configuration” page will open.</div> <div class="image-green-border"> </div> <div class="image-green-border">[[File:SSO Config 8.2 1.png|720px|SSO Config 8.2 1.png]]</div> <div class="image-green-border"> </div> <div class="image-green-border">'''Note: '''User need to have the SSO admin user role assigned to make SSO configuration changes</div> <div class="image-green-border"> </div> <div class="image-green-border">[[File:SSO Admin.png|720px]]</div> <div class="image-green-border"> </div> <div class="image-green-border"> |
<span style="color:#FF0000;">'''WARNING!'''</span> | <span style="color:#FF0000;">'''WARNING!'''</span> | ||
| Line 16: | Line 16: | ||
3. Click “Create” button, from the dropdown select the required SSO Configuration to be done from “SAML2 Configuration”, “WS Fed Configuration” and “OAuth2 Configuration”. | 3. Click “Create” button, from the dropdown select the required SSO Configuration to be done from “SAML2 Configuration”, “WS Fed Configuration” and “OAuth2 Configuration”. | ||
| − | [[File:SSO Config 8.2 2.png|720px]] | + | [[File:SSO Config 8.2 2.png|720px|SSO Config 8.2 2.png]] |
=== '''SAML2 Configuration''' === | === '''SAML2 Configuration''' === | ||
| Line 30: | Line 30: | ||
4. From the “Create” dropdown click “SAML2 Configuration”. The “Create SAML2 Configuration” page will open. | 4. From the “Create” dropdown click “SAML2 Configuration”. The “Create SAML2 Configuration” page will open. | ||
| − | [[File:SSO Config 8.2 3.png|720px]] | + | [[File:SSO Config 8.2 3.png|720px|SSO Config 8.2 3.png]] |
5. Select the “Request Signing Certificate” from the dropdown. | 5. Select the “Request Signing Certificate” from the dropdown. | ||
| − | [[File:SSO Config 8.2 4.png|720px]] | + | [[File:SSO Config 8.2 4.png|720px|SSO Config 8.2 4.png]] |
<div class="note-box">'''Note: '''If no certificate is selected, please ensure to keep the 'Enable SP Initiated Logout' turned off while configuring the Identity Providers in the next step. If it is turned on and you have not selected the certificate, you would need to select a certificate, re-generate the metadata and complete the configuration again to ensure seamless logins for all users.</div> | <div class="note-box">'''Note: '''If no certificate is selected, please ensure to keep the 'Enable SP Initiated Logout' turned off while configuring the Identity Providers in the next step. If it is turned on and you have not selected the certificate, you would need to select a certificate, re-generate the metadata and complete the configuration again to ensure seamless logins for all users.</div> | ||
6. Select the “Assertion Encryption Certificate” from the dropdown. | 6. Select the “Assertion Encryption Certificate” from the dropdown. | ||
| Line 40: | Line 40: | ||
7. Select the “Bidding Type” from the dropdown. | 7. Select the “Bidding Type” from the dropdown. | ||
| − | [[File:SSO Config 8.2 5.png|720px]] | + | [[File:SSO Config 8.2 5.png|720px|SSO Config 8.2 5.png]] |
8. Toggle the “Authentication Request Signed” and “Assertions Signed” switch as required. | 8. Toggle the “Authentication Request Signed” and “Assertions Signed” switch as required. | ||
| Line 46: | Line 46: | ||
9. Click “Generate Metadata” button once all the necessary fields are filled. The Metadata file will get downloaded in the system. | 9. Click “Generate Metadata” button once all the necessary fields are filled. The Metadata file will get downloaded in the system. | ||
| − | [[File:SSO Config 8.2 6.png|720px]] | + | [[File:SSO Config 8.2 6.png|720px|SSO Config 8.2 6.png]] |
<div class="note-box">'''Note: '''To reflect the updated information in the file, please ensure to re-generate Metadata, in case any field is modified.</div> | <div class="note-box">'''Note: '''To reflect the updated information in the file, please ensure to re-generate Metadata, in case any field is modified.</div> | ||
10. Click “Next”. The next page to add “Service Provider” and “Identity Provider” will open. | 10. Click “Next”. The next page to add “Service Provider” and “Identity Provider” will open. | ||
| Line 52: | Line 52: | ||
11. To add a “Service Provider”, click “Add Provider” button next to “Service Provider”. The “Add Service Provider” drawer will open. | 11. To add a “Service Provider”, click “Add Provider” button next to “Service Provider”. The “Add Service Provider” drawer will open. | ||
| − | [[File:SSO Config 8.2 7.png|720px]] | + | [[File:SSO Config 8.2 7.png|720px|SSO Config 8.2 7.png]] |
12. Enter the “Logout URL”. Click “Save”. | 12. Enter the “Logout URL”. Click “Save”. | ||
| Line 58: | Line 58: | ||
13. To add an “Identity Provider”, click “Add Provider” button next to “Identity Provider”. The “Add Identity Provider” drawer will open. | 13. To add an “Identity Provider”, click “Add Provider” button next to “Identity Provider”. The “Add Identity Provider” drawer will open. | ||
| − | [[File:SSO Config 8.2 8.png|720px]] | + | [[File:SSO Config 8.2 8.png|720px|SSO Config 8.2 8.png]] |
14. Enter the “Metadata Location”. | 14. Enter the “Metadata Location”. | ||
| Line 70: | Line 70: | ||
18. Once both “Service provider” and “Identity Provider” are added. Click “Save”. The SAML2 Configuration will be configured. | 18. Once both “Service provider” and “Identity Provider” are added. Click “Save”. The SAML2 Configuration will be configured. | ||
| − | [[File:SSO Config 8.2 9.png|720px]] | + | [[File:SSO Config 8.2 9.png|720px|SSO Config 8.2 9.png]] |
=== '''WS-Fed Configuration''' === | === '''WS-Fed Configuration''' === | ||
| Line 86: | Line 86: | ||
*Metadata URL: The URL where metadata document is hosted, to be shared with Icertis. | *Metadata URL: The URL where metadata document is hosted, to be shared with Icertis. | ||
| − | [[File:SSO Config 8.2 10.png|500px]] | + | [[File:SSO Config 8.2 10.png|500px|SSO Config 8.2 10.png]] |
20. Select the “Unique Claim Type” from “Select Unique Claim Type” dropdown. | 20. Select the “Unique Claim Type” from “Select Unique Claim Type” dropdown. | ||
| Line 109: | Line 109: | ||
*Token URL: The URL to which ICI will send an Authorization Code to get an access token from IdP. | *Token URL: The URL to which ICI will send an Authorization Code to get an access token from IdP. | ||
| − | [[File:SSO Config 8.2 11.png|500px]] | + | [[File:SSO Config 8.2 11.png|500px|SSO Config 8.2 11.png]] |
23. Enter the “Resource Owner Profile URL”, “IDP Logout URL”, “Redirect URL” and “Issuer” details. | 23. Enter the “Resource Owner Profile URL”, “IDP Logout URL”, “Redirect URL” and “Issuer” details. | ||
| Line 117: | Line 117: | ||
*Issuer: The OAuth issuer URL. | *Issuer: The OAuth issuer URL. | ||
| − | [[File:SSO Config 8.2 11.png|500px]] | + | [[File:SSO Config 8.2 11.png|500px|SSO Config 8.2 11.png]] |
24. Enter “Provider” details and “Post Logout Redirect URL”. | 24. Enter “Provider” details and “Post Logout Redirect URL”. | ||
| Line 145: | Line 145: | ||
1. Click three dots next to the SSO configuration you want to edit, on the SSO Configuration index page. | 1. Click three dots next to the SSO configuration you want to edit, on the SSO Configuration index page. | ||
| − | [[File:SSO Config 8.2 13.png|720px]] | + | [[File:SSO Config 8.2 13.png|720px|SSO Config 8.2 13.png]] |
2. The Edit SSO Configuration page will open, make the required edits and click “Save”. | 2. The Edit SSO Configuration page will open, make the required edits and click “Save”. | ||
| − | [[File:SSO Config 8.2 14.png|400px]] | + | [[File:SSO Config 8.2 14.png|400px|SSO Config 8.2 14.png]] |
| | ||
Revision as of 06:33, 3 November 2022
Contents
SSO Configuration
What is SSO Configuration?
SSO is an authentication process that allows users to access multiple applications, after signing in once. Icertis supports SAML, OAuth and WS-Fed as Authentication protocols. This utility will also support configurations for all 3 protocols.
Performing SSO Configuration
1. Click “Configure” tile and click “System Configuration”. The “System Configuration – Self-Service” tab will open.
WARNING!
The steps mentioned here must be performed by individuals with understanding and expertise of the SSO configuration process. If an incorrect configuration is deployed, users in your organization will not be able to access Icertis Contract Intelligence. If such an event occurs, you will need to contact us for support and rectification.
3. Click “Create” button, from the dropdown select the required SSO Configuration to be done from “SAML2 Configuration”, “WS Fed Configuration” and “OAuth2 Configuration”.
SAML2 Configuration
This facilitates you to configure single-sign-on using SAML protocol on the instance. The configuration supports single and multiple service providers. While creating a SAML configuration you need to perform the following steps:
- Generating the ICI Metadata – This generates the Service Provider (SP) metadata to be shared with the Identity Provider (IdP). You need to select the certificate and then generate the metadata. This builds and downloads the XML Metadata of the ICI SAML Service Provider.
- Configuration – Fill in the SSO form with the correct IdP details as per the fields provided. If only 1 IdP is created, it will be treated as a Single Service Provider configuration and if multiple IdP’s are created, it will be treated as a Multiple Service Provider configuration.
- Deploy – Once the configuration is complete, it will be pushed to the instance and updated at the required locations.
How to perform SAML2 Configuration
4. From the “Create” dropdown click “SAML2 Configuration”. The “Create SAML2 Configuration” page will open.
5. Select the “Request Signing Certificate” from the dropdown.
6. Select the “Assertion Encryption Certificate” from the dropdown.
7. Select the “Bidding Type” from the dropdown.
8. Toggle the “Authentication Request Signed” and “Assertions Signed” switch as required.
9. Click “Generate Metadata” button once all the necessary fields are filled. The Metadata file will get downloaded in the system.
10. Click “Next”. The next page to add “Service Provider” and “Identity Provider” will open.
11. To add a “Service Provider”, click “Add Provider” button next to “Service Provider”. The “Add Service Provider” drawer will open.
12. Enter the “Logout URL”. Click “Save”.
13. To add an “Identity Provider”, click “Add Provider” button next to “Identity Provider”. The “Add Identity Provider” drawer will open.
14. Enter the “Metadata Location”.
15. Toggle the “Enable SP Initiated Logout” switch.
16. Select “Unique Claim Type” from the “Select Claim Type” dropdown.
17. Click “Save”. The drawer will close.
18. Once both “Service provider” and “Identity Provider” are added. Click “Save”. The SAML2 Configuration will be configured.
WS-Fed Configuration
This facilitates you to configure single-sign-on using WS-Fed protocol on the instance. While creating a WS-Fed configuration you need to perform the following steps:
- Configuration - Fill in the SSO form with the correct IdP details as per the fields provided.
- Deploy – Once the configuration is complete, it will be pushed to the instance and updated at the required locations.
How to Perform WS-Fed Configuration
- Enter the “Realm” details, “Issuer” details, “Metadata URL”.
- Realm: This name is the unique identifier that is included in assertions sent to federation partners.
- Issuer: Specifies the URL at which the IdP or service provider is providing WS-Federation services.
- Metadata URL: The URL where metadata document is hosted, to be shared with Icertis.
20. Select the “Unique Claim Type” from “Select Unique Claim Type” dropdown.
21. Click “Save”.
OAuth2 Configuration
This facilitates you to configure single-sign-on using OAuth protocol on the instance. While creating an OAuth configuration you need to perform the following steps:
- Configuration - Fill in the SSO form with the correct IdP details as per the fields provided.
- Deploy – Once the configuration is complete, it will be pushed to the instance and updated at the required locations.
How to perform OAuth2 Configuration
22. Enter “Client ID”, “Client Secret”, “Scope”, “Authorization URL”, “Token URL”.
- Client ID: Identifies the client that is making the request. The Client ID obtained from the IdP after registering application with OAuth server and will be provided by IdP.
- Client Secret: Identifies the client secret that is making the request. The client secret obtained from the IdP after registering application with OAuth server and will be provided by IdP.
- Scope: Mechanism to limit an application's access to a user's account. An application can request one or more scopes. This information is then presented to the user in the consent screen, and the access token issued to the application will be limited to the scopes granted.
- Authorization URL: The URL to which ICI will send the Authorization Code request.
- Token URL: The URL to which ICI will send an Authorization Code to get an access token from IdP.
23. Enter the “Resource Owner Profile URL”, “IDP Logout URL”, “Redirect URL” and “Issuer” details.
- Resource Owner Profile URL: The URL provided by IdP, which ICI will use to retrieve extra information about the user. This is an optional field.
- IDP Logout URL: The URL provided by IdP to which ICI will send the logout request message.
- Issuer: The OAuth issuer URL.
24. Enter “Provider” details and “Post Logout Redirect URL”.
25. Select “Respond Mode” from “Select Response Mode” dropdown.
26. Select the required “Response Type”.
- Response Type: Informs the Authorization Server of the mechanism to be used for returning Authorization Response parameters from the Authorization Endpoint. 'Code' indicates requesting an authorization code, 'Token' indicates requesting an access token (implicit/grant).
27. Enter “Tenant” details and “Policy ID”.
28. Select the “Unique Claim Type” from “Select Unique Claim Type” dropdown.
29. Click “Save”
Deploying SSO Configuration
Once the configuration is ready for deployment, user will be able to deploy the current configurations
1. Click “Deploy” from the three dots menu, user will be asked to enter external UPN of its current user.
Once the user enters the external UPN and clicks on deploy the configurations, the configuration will get deploy on the server which will change the SSO type appointing to the new configuration.
Editing SSO Configurations
1. Click three dots next to the SSO configuration you want to edit, on the SSO Configuration index page.
2. The Edit SSO Configuration page will open, make the required edits and click “Save”.
