Migrating Single Sign-On access and users to the Thredd platform

Thredd's Secure Framework supports industry standard identity and access management and protocols for authentication, Single Sign-On (SSO) with token lifecycle management, secure role-based access control, and secure network and API-level connectivity. Thredd's scalable security architecture roadmap is aligned with emerging standards and regulatory requirements.

In the context of this work, Thredd has enhanced the Identity Provider (IdP) capability for Thredd's interfaces, including Thredd Portal and its Certificate Authority.

These enhancements enable users with an Organisation Admin role to manage settings and access for their organisation, users, including SSO configuration, and applications through Thredd Portal.

Using Single Sign-On (SSO) enables you to automate user onboarding; you can invite users to log in to Thredd Portal URL and automatically create their accounts. This eliminates the need to manually add and invite users in Thredd Portal.

Migrating from Cloudentity for existing clients

As part of the enhancements to the Thredd platform, Thredd is phasing out support for the Cloudentity identity provider.

If your organisation currently uses Cloudentity, you can migrate to Thredd Portal and the current identity and access management platform after you receive confirmation from Thredd that your migration is ready.

For best practice, Thredd recommends that you complete and verify the migration in the UAT environment before completing the equivalent setup in Production.

Before you begin

  • You must have the Organisation Admin role for your organisation.

  • You must have received confirmation from Thredd that your organisation is ready to migrate.

  • You must have access to your organisation's identity provider configuration so that you can verify the migrated SSO settings.

Step 1: Log in to Thredd Portal for the first time

Once Thredd has completed the initial step of registering your organisation and Organisation Admin user in the platform, it sends an invitation to the Organisation Admin containing a link to log in to the Thredd Portal and set up your access as the Organisation Admin.

You need to refer to the email to log in to the Thredd Portal for the first time.

  1. In Thredd Portal, navigate to the User Management area within System Admin, then select Add SSO Provider.

  2. Enter the details for the identity provider, including its name and a description.

  3. Select the protocol used by your identity provider: SAML 2.0 or OpenID Connect (OIDC).

    • SAML 2.0 — provide the SAML metadata using one of the following methods:

      • Metadata URL — enter the metadata URL provided by your identity provider.

      • Metadata XML — provide the XML metadata supplied by your identity provider.

    • OpenID Connect (OIDC) — provide the required configuration details from your identity provider. Depending on your configuration, these can include:

      • Authorization Endpoint

      • Client ID

      • Client Secret

      • Discovery URL

      • Issuer

      • Response Mode

      • Response Type

      • Scopes

      • Token Endpoint

      • User Info Endpoint

      Complete all fields marked as required in Thredd Portal. Other fields depend on your identity provider configuration.

  4. Configure the attribute mappings between your identity provider and Thredd. The default external attribute is email. Select Add Attribute mapping if you need additional mappings.

  5. Select Next. The Review & Submit page opens.

  6. Review the details and select Save Configuration.

  7. When you save the configuration, Thredd Portal runs a health check to validate it. If validation succeeds, the identity provider is added as an active SSO configuration. If validation fails, review the reported errors and correct the configuration.

If you want to use more than one SSO configuration, you can create a new configuration via the User Admin > SSO Configuration area of Thredd Portal. SSO is used to sign in to Thredd Portal and supported services accessed through it. It is not used to authenticate connections to Thredd REST APIs.

Testing API Hub access using the latest Postman Collection

At this point, you can either choose to:

  • Continue with setting up access for your organisation's users (as per step 3 of this guide). After this, test making API calls using the Postman Collection.

  • Test access to the API Hub first. This involves downloading and configuring the latest Postman Collection to make API calls. You can then return to this guide later to set up access for your organisation's users.

For information about connecting to Thredd REST APIs and using the latest Postman Collection, see Connecting to the REST APIs.

Step 3: Configure user access to the Thredd platform

To ensure that the users for your organisation can access the Thredd platform, you must invite users via your SSO provider. When a new user tries to log in to Thredd Portal, it registers them and assigns the Read-Only role by default.

An Organisation Admin can view the users that are registered for their organisation in Thredd Portal, and complete the following tasks:

  • Manage user access, deactivate or reactivate a user's access to the platform.

  • Assign the appropriate roles and permissions to a user.

  • Edit user details, such as the email address that a user logs in with.

  • Resend invitations to users.

You must ensure that you configure access for any users who require it, but you can complete this task when you are ready to do so. For example, if you want to first test your organisation's connection to Thredd, such as the REST APIs, and then return to this step.

To view and manage users:

  1. Navigate to System Admin and select User Management.

  2. The User Management screen appears, and displays a directory of users by default.

    3. To add more users, you must invite them via your SSO provider.

  3. The Users screen displays a summary of information about each user in the following columns:

    • User ID

    • First Name

    • Last Name

    • Email Address

    • Role — displays all roles assigned to a user, which can be more than one role.

    • Status — indicates if a user has logged in to Thredd Portal and is active after receiving an invitation and changing their password.

    • Last logged in

    • IP Address

    • Actions — the action menu for each user, which you can use to review or edit the details and role of a user.

  4. Configure the attribute mappings between your identity provider and Thredd. The default external attribute is email. Select Add Attribute Mapping if you need additional mappings.

  5. Select Next. The Review & Submit page opens.

  6. Review the details and select Save Configuration.

  7. When you save the configuration, Thredd Portal runs a health check to validate it. If validation succeeds, the identity provider is added as an active SSO configuration. If validation fails, review the reported errors and correct the configuration.

SSO is used to sign in to Thredd Portal and supported services accessed through it. It is not used to authenticate connections to Thredd REST APIs.

Step 3: Review user access

After you have confirmed the SSO configuration, review the users registered for your organisation and make sure that they have the appropriate access.

An Organisation Admin can:

  • View users registered for the organisation.

  • Manage user access, including deactivating or reactivating access.

  • Assign the appropriate roles and permissions.

  • Edit user details.

If your organisation uses SSO, invite new users through your identity provider. When a new user signs in successfully, Thredd Portal registers the user and you can assign the appropriate roles and permissions.

Organisation Admins can manage users from the User Management area within the System Admin menu in Thredd Portal.

You can review user access after validating your SSO configuration. You do not need to complete user administration before testing other parts of your UAT setup.

Step 4: Continue testing your connection

After you have reviewed your SSO configuration, you can continue testing the services included in your migration.

For information about connecting to Thredd REST APIs and using the latest Postman Collection, see Connecting to the REST APIs.

 

Example SSO integrations are available in the SSO Sample Integration section of the Connecting to Thredd Guide.

Example SSO integrations are available in the SSO Sample Integration section of the Connecting to Thredd Guide.