Single sign-on and SAML

Let users log in to Cloud Management Platform (CMP) through your organization’s single sign-on (SSO) identity provider, using SAML

  2 minute read  

SSO lets users authenticate to CMP through a central identity provider (IdP), which acts as the single source of truth for user identity. Organizations use SSO to manage access to all their applications from one place, so users maintain just one set of credentials. CMP supports SSO through the SAML protocol.

Prerequisites

  • Set up at least one branded portal. Its URL determines the metadata and ACS URL.

Configuration process

Configuring SSO involves both CMP and your IdP:

  1. Configure the single sign-on IdP in CMP.
  2. Configure the CMP service provider (SP) in your IdP.
  3. Set up attribute statements.
  4. Import metadata. CMP and the IdP each require XML metadata from the other.

Glossary

Term Definition
Single sign-on (SSO) A design pattern in which users log in once to access many applications. Access is controlled from a single place, and users maintain only one set of credentials.
SAML (Security Assertion Markup Language) The protocol that the IdP and SP use to communicate. It is a subset of XML.
Identity Provider (IdP) An SSO application such as Okta or OneLogin.
Service Provider (SP) An application that uses an IdP to authenticate users. CMP is the service provider.
Assertion Consumer Service (ACS) The endpoint a service provider exposes for the identity provider to send its SAML response (assertion) to.
Metadata An XML document describing an IdP or SP, including information such as the ACS endpoint and which user attributes are required or allowed.
Set up SSO and SAML

Add a single sign-on (SSO) identity provider in Cloud Management Platform (CMP) and exchange SAML metadata with it

Configure the identity provider

Configure your identity provider (IdP) to work with the SSO provider you set up in Cloud Management Platform (CMP)

Log in via SSO

Log in to Cloud Management Platform (CMP) through a linked single sign-on (SSO) identity provider

Microsoft Entra identity provider

Set up single sign-on (SSO) for Cloud Management Platform (CMP) using Microsoft Entra (formerly Azure AD)

Office 365 identity provider

Set up single sign-on (SSO) for Cloud Management Platform (CMP) using Office 365

Okta identity provider

Set up single sign-on (SSO) for Cloud Management Platform (CMP) using Okta

OneLogin identity provider

Set up single sign-on (SSO) for Cloud Management Platform (CMP) using OneLogin

PingOne for Enterprise identity provider

Set up single sign-on (SSO) for Cloud Management Platform (CMP) using PingOne for Enterprise

SSO group mapping

Map user groups from your single sign-on (SSO) provider to Cloud Management Platform (CMP), automatically provisioning CMP roles, permissions, and groups from SSO group membership

SSO orchestration actions

Define how users are managed during SSO login using orchestration actions

Integration with other systems

Learn how SSO/SAML integrates with Cloud Management Platform (CMP)