Integration with other systems
2 minute read
Local authentication for SSO users
By default, users created through SSO login are not assigned a local password. These users are always required to log in through SSO and cannot use local authentication.
Enable local login for SSO-created users
To let these users log in with a local CMP password, an admin assigns a password to the user in CMP.
Portals
Portals created through the branded portals feature can be associated with a single SSO provider.
Portals serve a few purposes for CMP’s SSO providers:
- Determining the domain name for the Assertion Consumer Service (ACS) and metadata URLs. Both ACS and metadata URLs are included in the SSO provider’s metadata generated by CMP and displayed on the SSO provider’s details page.
- Determining which SSO provider, if any, is linked from the CMP login page, depending on which domain name the user is accessing the site from.
Each portal can be linked to only a single SSO provider. Multiple SSO providers for a single domain name are not supported.
SSO users can start the SSO login process from CMP only when the SSO provider is linked to the portal. If the provider is not linked to a portal, users can log in to CMP only from their IdP.
External user sync
External Users Sync orchestration actions run as part of CMP’s Assertion Consumer Service whenever CMP logs an SSO user in. See User permission and attribute synchronization.