Single Sign-on

    Single sign-on (SSO) is an authentication method that lets users access multiple applications with a single set of credentials. Users sign in once and then open each connected application with one click, without re-entering credentials for every application. This reduces login friction and improves productivity, reduces password fatigue and the reuse of weak passwords, and cuts down on password-reset help desk requests. It also lets administrators enforce secure access for business-critical applications while keeping centralized control over application access and security policies.

    Sign-in methods

    You can configure SSO for an application using one of three sign-in methods:

    • SAML: An XML-based protocol that links authentication and authorization services to access protected resources. It uses the widely adopted SAML 2.0 standard.
    • OAuth/OpenID Connect: An authorization protocol, extended to support SSO for web applications. OAuth 2.0 grants an application access on the user's behalf without sharing their credentials, and OpenID Connect adds the identity layer that authenticates the user. The application signs the user in using the resulting OAuth or OIDC tokens.
    • Bookmark: Saves an application's login URL to provide one-click access. It suits legacy or non-SAML/OAuth applications.

    Adding applications

    You can enable SSO for hundreds of pre-integrated applications from the catalog, or for your own custom applications:

    • Pre-integrated applications: Choose a ready-made application from the catalog and configure SSO for it. See Add existing app integrations.
    • Custom applications: Integrate your own internal or non-gallery application using SAML, OAuth/OpenID Connect, or Bookmark. See Integrate custom apps.

    The Single Sign-on dashboard

    The Single Sign-on page lists every application configured for SSO and gives you the controls to manage them. To manage access, select one or more applications and use the assign or unassign options to grant or restrict access for specific users and groups. The list shows the following details and controls for each application:

    The Single Sign-on dashboard
    Fig 1: The Single Sign-on dashboard, listing the applications configured for SSO and their management controls.
    • Application Name: The name of the application configured for SSO.
    • Sign-in Method: The protocol used for the SSO configuration (SAML, OAuth/OpenID Connect, or Bookmark).
    • IdP Details: For SAML and OAuth/OpenID Connect applications, click View to get the identity provider details which you enter into the application. The sign-in method determines which details appear, and which of them you need depends on the application's requirements. Copy or download all the values the application asks for.
      • For SAML, the details are the Login URL, Logout URL, and Entity ID/Issuer URL, along with the signing certificate, its fingerprint, and the metadata as a file or a URL.
      • For OAuth/OpenID Connect, they are the Client ID and Client Secret, the Issuer, and the authorization, token, user, keys, revocation endpoint URLs, and Well-known configuration URL or Discovery URL.
      • Bookmark applications have no IdP details, so this column shows a dash.
    • Assigned To: View and manage the users and groups assigned to the application. Click the users or groups icon to assign the application, or select assigned users and groups to unassign it. Only assigned users and members of assigned groups can access the application through SSO.
    • SAML Certificate Expiring On: Shows the expiry date of the application's SAML certificate, which is valid for one year by default. Click Renew to generate a new X.509 certificate and IdP metadata file and update the SSO configuration. Renew the certificate before it expires to keep SAML SSO working.
    • SSO Attribute Mapping: Click Customize to control how user information is sent to the application during SSO. Applications expect user attributes under specific names, so mapping ensures each application receives the right values to identify the user and populate their profile. Map Universal Directory Attributes (such as Email, Display Name, Department, or Employee ID) to the attributes the application expects so user details transfer accurately, or use Naming Formats to apply custom naming conventions.