Single sign-on and SAML on CloudBolt Documentation

Set up SSO and SAML

Mon, 01 Jan 0001 00:00:00 +0000

Add the SSO provider in CMP

Go to Admin > Single Sign-On (SSO).
Select Add.
Select the IdP type. The type only affects how the IdP appears in the CMP UI and some initial option defaults; any IdP type can be configured to work as any other.
Complete the SAML settings as needed. The selected Signing Algorithm must match the IdP.
Select Create.

(opens full-size image in a new tab)
Select Download Metadata XML to download the metadata file. You need it when configuring your IdP for single sign-on.
Configure the identity provider (see Configure the identity provider) and obtain its metadata.
In CMP, go to Admin > Single Sign-On (SSO), select the IdP, select Upload IdP XML, and upload the IdP metadata.

Configure the identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Choose your identity provider

Typically, you send your CMP service provider’s metadata to the IdP. Select your identity provider below for its setup steps:

(opens full-size image in a new tab)

Required fields

Include the following on your IdP configuration. The IdP can extract some or all of these from the CMP service provider’s metadata:

Log in via SSO

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML.

Log in from the CMP UI

How you are prompted to log in depends on the Automatically Login to SSO setting:

Setting	Description
Enabled	You are taken directly to the SSO provider’s login page when you access CMP. If Force Authentication is enabled on the SSO provider in CMP, you must log in to the SSO provider manually.
Disabled	The default. In the CMP UI, select the Log In with <SSO provider name> button.

In both cases, CMP sends a Security Assertion Markup Language (SAML) request identifying the user to the IdP: automatically when the setting is enabled, or when you select Log In with… when it is disabled.

Microsoft Entra identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create the branded portal for this SSO provider.

Configure Microsoft Entra as the IdP

Log in to the Azure portal.
Go to Enterprise Applications.

(opens full-size image in a new tab)
Select + New Application, then search for and select Microsoft Entra SAML Toolkit.

(opens full-size image in a new tab)

The create dialog appears.

(opens full-size image in a new tab)
Enter a name for the CMP application and select Create. The application is added to your enterprise applications.
Select Microsoft Entra SAML Toolkit, then select Set up single sign-on to start configuring it for CMP.

(opens full-size image in a new tab)
On the single sign-on page, select SAML.

(opens full-size image in a new tab)
In the Basic SAML Configuration section, set Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL to point to your CMP instance.

(opens full-size image in a new tab)
Alternatively, select Upload metadata file and upload the metadata file you downloaded in step 6 of Set up SSO and SAML. The Basic SAML settings are then configured automatically from your metadata XML.

(opens full-size image in a new tab)
Ensure the Sign on URL is set.
Select Save.
When prompted to test the connection, select No, I’ll test later.
Under SAML Certificates, select Download for Federation Metadata XML.

(opens full-size image in a new tab)
Save the metadata XML. You need it in Set up SSO and SAML.
Select Edit on the SAML settings section and ensure the Signing Algorithm matches the one you set in the SAML settings in Set up SSO and SAML.

(opens full-size image in a new tab)

Office 365 identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Office 365 uses the same setup as Microsoft Entra (formerly Azure AD). The screenshots here are from the Microsoft Entra SSO interface.

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create at least one branded portal for this SSO provider.

Configure Office 365

In Office 365, configure an enterprise application linked to SSO for CMP.

In Office 365, manage the enterprise application.
In the Manage menu, select Single sign-on. Set Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL to point to your CMP instance.

(opens full-size image in a new tab)

Okta identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create at least one branded portal for this SSO provider.
Have an Okta administrator account that can create an application and add users.
Have an Okta organization.

Add the Okta SSO provider in CMP

Log in to CMP as an administrator.
Select Admin > Single Sign-On (SSO).
Select Add > Okta.
Complete the SAML settings form.

You need the Single Sign-On URL and Metadata URL / Entity ID for the Okta application.

OneLogin identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create at least one branded portal for this SSO provider.
Have a OneLogin administrator account that can create applications and add users.
Have a OneLogin organization.

Add the OneLogin SSO provider in CMP

Log in to CMP as an administrator.
Select Admin > Single Sign-On (SSO).
Select Add > Generic SAML Provider.
Complete the SAML settings form.

You need the Single Sign-On URL and Metadata URL / Entity ID for the OneLogin application setup below.

PingOne for Enterprise identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Create at least one branded portal for this SSO provider. Its URL determines the metadata and ACS URL.
Have an administrator account in PingOne for Enterprise that can create an application and add users.
Have a PingOne organization.

PingOne also offers a similar product, PingIdentity SSO. CMP can integrate with it as well, but this guide covers PingOne for Enterprise specifically.

Set up PingOne in CMP

In CMP, log in as an administrator.
Select Admin > Single Sign-On (SSO).
Select Add > Generic SAML Provider.
Complete the SAML settings form, selecting the branded portal for this provider.
Select Create.
Copy and store the Single Sign-On URL and Metadata URL / Entity ID, and select Download Metadata XML. You use these later during PingOne setup.

Create the PingOne application

Connect to the PingOne directory

Log in to the PingOne for Enterprise web interface.
In the top navigation menu, select Setup > Identity Repository > Connect to an Identity Repository.
1. For Connect to an Identity Repository, select PingOne Directory, then select Next.
2. After the directory is configured, select Next.
3. Make note of the Map Attributes; you use them later.
Select Finished.

Add the PingOne SAML application

In the top navigation menu, select Applications > Add Application > Search Application Catalog.
Search for “Ping”, then select the arrow next to Ping IDaaS Directory Provisioner > Setup.

(opens full-size image in a new tab)

SSO group mapping

Mon, 01 Jan 0001 00:00:00 +0000

Group mapping eliminates the need for a CMP administrator to manually configure roles and permissions after each SSO login.

Before you begin

Ensure that:

Your SSO IdP is configured.
CMP is connected to your SSO IdP.
Groups and users are configured in your SSO IdP.
You have a list of the SSO IdP group IDs.

Create a group mapping

Map a user group from your SSO IdP to CMP.

Log in to CMP as an administrator.
Go to Admin > Single Sign-On (SSO).

(opens full-size image in a new tab)
Select your SSO IdP.
Select the Mapping tab.
Select New SSO Mapping.

(opens full-size image in a new tab)
Provide the Group Identifier.

This must match the group ID from your SSO IdP.
Enter a Group Display Name.
Grant the global roles (Super Admin, Devops Admin, Global Viewer) as required.
Assign Admin Roles as required.
Select Save.

SSO orchestration actions

Mon, 01 Jan 0001 00:00:00 +0000

In Cloud Management Platform (CMP), SSO orchestration actions control how users, groups, roles, and directory associations are handled when a user logs in through single sign-on (SSO).

You can use:

SSO User Update
External Users Sync
A combination of both

The default SSO User Update action provides basic behavior, such as associating users with an LDAP domain and updating standard user fields. For advanced requirements, such as group mapping or attribute synchronization, you can customize this action or use the External Users Sync action.

Integration with other systems

Mon, 01 Jan 0001 00:00:00 +0000

Local authentication for SSO users

By default, users created through SSO login are not assigned a local password. These users are always required to log in through SSO and cannot use local authentication.

To let these users log in with a local CMP password, an admin assigns a password to the user in CMP.

Portals

Portals created through the branded portals feature can be associated with a single SSO provider.

Single sign-on and SAML on CloudBolt Documentation

Set up SSO and SAML

Add the SSO provider in CMP

Configure the identity provider

Choose your identity provider

Required fields

Log in via SSO

Before you begin

Log in from the CMP UI

Microsoft Entra identity provider

Before you begin

Configure Microsoft Entra as the IdP

Office 365 identity provider

Before you begin

Configure Office 365

Okta identity provider

Before you begin

Add the Okta SSO provider in CMP

OneLogin identity provider

Before you begin

Add the OneLogin SSO provider in CMP

PingOne for Enterprise identity provider

Before you begin

Set up PingOne in CMP

Create the PingOne application

Connect to the PingOne directory

Add the PingOne SAML application

SSO group mapping

Before you begin

Create a group mapping

SSO orchestration actions

Integration with other systems

Local authentication for SSO users

Enable local login for SSO-created users

Portals