Log in via SSO

Log in to Cloud Management Platform (CMP) through a linked single sign-on (SSO) identity provider

  2 minute read  

Before you begin

Complete Set up SSO and SAML.

Log in from the CMP UI

How you are prompted to log in depends on the Automatically Login to SSO setting:

Setting Description
Enabled You are taken directly to the SSO provider’s login page when you access CMP. If Force Authentication is enabled on the SSO provider in CMP, you must log in to the SSO provider manually.
Disabled The default. In the CMP UI, select the Log In with <SSO provider name> button.

In both cases, CMP sends a Security Assertion Markup Language (SAML) request identifying the user to the IdP: automatically when the setting is enabled, or when you select Log In with… when it is disabled.

If the SSO provider is misconfigured, for example, if its IdP metadata is missing, CMP shows the login form with a message to log in with a local account instead. This happens even when Automatically Login to SSO is enabled.

What happens during login

  1. Log in to the SSO IdP if you are not already logged in.
  2. If prompted, select CMP from your available applications (you may also be redirected automatically). Then:
    • The IdP sends a SAML response to CMP with your information.
    • CMP validates the response.
    • CMP identifies the user named in the IdP’s SAML assertion.
  3. If CMP cannot find a matching user:
    • If Create Unknown Users is enabled on the SSO provider, CMP creates a new user from the IdP’s information.
    • If it is disabled, CMP does not create a user and returns you to the login page.

When enabled, two orchestration actions run to update the incoming user: