SSO setup

To configure SSO, fill in the following connection parameters according to the data from the IdP service:

To set up SSO, follow these steps:

1. Go to Access management → SSO.
2. Select Edit connection.
3. Specify the following parameters:

• Base URL—the service URL;
• Application ID—the service ID;
• Application secret—the client key or secret from the service;
• Redirect URI—the URL to redirect to after authentication and authorization are complete (TRON.ASOC);
• Requested permissions—the parameters that define the permissions and data the application receives after authentication.

note

The parameters must match the data from the IdP service. See the IdP documentation for configuration details.

4. Fill in the attributes for mapping to the SSO service:

• Username;
• Last name;
• Display name;
• Group;
• Role.

info

For information about field mapping when integrating with SSO services, see below.

If users don't fill in the field values, the system uses the default field mapping.

5. If necessary, select the checkbox for Extract CN from group DN.

6. Select Save changes.

You also need to create roles and groups for SSO mapping. For more information, see Authentication method setup.

Field mapping when integrating with SSO services

The table below shows the default field mapping when integrating ASOC with SSO services.

SSO service user attributes	ASOC user attributes	Value	Required
sub	username	Username	Yes
email	email	Email address	Yes
-	password (ASOC generates a random password when it creates the account)	Password	Yes
family_name + given_name	display_name	Display name (First name + Last name)	No
groups.name	Group	Group	No
roles	Role	Role	No