Configuring SSO

To configure SSO, fill in the following connection parameters according to the data from the IdP service:

To configure SSO, follow these steps:

1. Go to Access management → SSO.
2. Select Edit connection.
3. Specify the following parameters:

• Base URL—the service URL;
• Application ID—the service ID;
• Application secret—the client key or secret from the service;
• Redirect URI—the URL to redirect to after the authentication and authorization process is complete (TRON.ASOC);
• Requested permissions—the parameters that define the permissions and data the application receives after authentication.

note

The parameters must match the data from the IdP service. Also refer to the IdP documentation for configuration instructions.

4. Fill in the attributes for mapping to the SSO service:

• Username;
• Last name;
• Display name;
• Group;
• Role.

info

For information about field mapping when integrating with SSO services, see below.

If users don't fill in field values, the default field mapping is used.

5. If necessary, select the checkbox in the Extract CN from group DNs field.

6. Select Save changes.

You also need to create roles and groups for SSO mapping. For more information, see Configuring the authentication method.

Field mapping when integrating with SSO services

The default field mapping when integrating ASOC with SSO services appears in the table below.

SSO service user attributes	ASOC user attributes	Value	Required
sub	username	Username	Yes
email	email	Email address	Yes
-	password (ASOC generates a random password when it creates the account)	Password	Yes
family_name + given_name	display_name	Display name (First name + Last name)	No
groups.name	Group	Group	No
roles	Role	Role	No