14 Set up and manage Single Sign-On
Single Sign-On (SSO) enables users in your organisation to authenticate using your organisation's identity provider (IdP) when accessing Thredd Portal and supported services accessed through it.
An Organisation Admin can create and manage SSO configurations for their organisation in Thredd Portal.
You configure SSO once for your organisation. Thredd Portal supports SAML 2.0 and OpenID Connect (OIDC).
SSO is used to sign in to Thredd Portal and supported services accessed through it. It is not used to authenticate connections to Thredd REST APIs.
For best practice, Thredd recommends that you configure and test SSO in the UAT environment before configuring your Production environment.
14.1 Before you begin
Before configuring SSO:
-
You must have the Organisation Admin role for your organisation.
-
You must have received confirmation from Thredd that your organisation is ready to use Thredd Portal.
-
You must have the configuration details for your organisation's identity provider.
14.2 Sign in to Thredd Portal for the first time
When Thredd has registered your organisation and Organisation Admin, you receive an email inviting you to access Thredd Portal.
Follow the instructions in the email to activate your account and sign in to Thredd Portal for the first time.
If the link in the email does not work or you need support, use the contact details provided in the email. Do not reply directly to the notification email.
14.3 Add an SSO configuration
The System Admin area in Thredd Portal enables you to create and manage identity providers for your organisation.
To add an SSO configuration:
-
In Thredd Portal, navigate to the User Management area in System Admin, then click the SSO Details tab.
-
Click Add SSO Provider.
-
Enter the details for the identity provider, including its name and a description.
-
Select the protocol used by your identity provider: SAML 2.0 or OpenID Connect (OIDC).
-
SAML 2.0 — provide the SAML metadata using one of the following methods:
-
Metadata URL — enter the metadata URL provided by your identity provider.
-
Metadata XML — provide the XML metadata supplied by your identity provider.
-
-
OpenID Connect (OIDC) — provide the required configuration details from your identity provider. Depending on your configuration, these can include:
-
Authorization Endpoint
-
Client ID
-
Client Secret
-
Discovery URL
-
Issuer
-
Response Mode
-
Response Type
-
Scopes
-
Token Endpoint
-
User Info Endpoint
Complete all fields marked as required in Thredd Portal. Other fields depend on your identity provider configuration.
-
-
-
Configure the attribute mappings between your identity provider and Thredd. The default external attribute is email. Select Add Attribute Mapping if you need additional mappings.
-
Select Next. The Review & Submit page opens.
-
Review the details and select Save Configuration.
When you save the configuration, Thredd Portal runs a health check to validate it. If validation succeeds, the identity provider is added as an active SSO configuration. If validation fails, review the reported errors and correct the configuration.
14.4 Manage an SSO configuration
You can view, edit, check or delete existing SSO configurations using the User Management area within the System Admin menu in Thredd Portal.
14.4.1 Edit an SSO configuration
-
Locate the configuration that you want to edit and open its Actions menu.
-
Select Edit.
-
Update the required configuration details.
-
Select Next.
-
Review the changes and select Save Configuration.
If you change settings that also apply to your identity provider, make the corresponding changes in your identity provider configuration.
14.4.2 Run a health check
You can run a health check at any time to validate an existing SSO configuration.
-
Locate the configuration that you want to check and open its Actions menu.
-
Select Run Health Check.
Thredd Portal reports whether the configuration passes validation. If validation fails, use the reported error to identify the configuration that needs to be corrected.
14.4.3 Delete an SSO configuration
-
Locate the configuration that you want to delete and open its Actions menu.
-
Select Delete.
-
Review the confirmation message.
-
Select Confirm and delete.
Deleting an SSO configuration permanently removes that sign-in method for users who rely on it. Before deleting a configuration, make sure affected users have another supported method of accessing the Thredd platform.