Single sign-on (SSO)

Modified on Mon, 29 Jul, 2019 at 1:10 PM

Overview


Policy Passport implements single sign-on (SSO) using the SAML 2.0 protocol. Policy Passport can be configured to work with two kinds of Identity Providers (IDPs). 

  • internal IDP: the one you see when log in to <sub-domain>.policypassport.com
  • external IDP: Companies provide an own IDP


Basic Authentication Flow

When the user tries to access the Policy Passport application in the browser, the Service Provider (SP) checks if the user is already authenticated. If not, then the user is redirected to the Identify Provider (IDP), which initiates the authentication (e.g. via username and password). After successful authentication, the user is redirected back to the Service Provider which grants access to the Policy Passport application. The IDP provides attributes, e.g. email address, to the Service Provider (SP) which are used to properly identify the user within Policy Passport.

SSO Authentication Flow

Supported IDPs

Policy Passport is tested and works with IDPs which support the SAML 2.0 protocol, e.g.


IDP NameIDP Documentation
Microsoft Active Directory Federation Services (AD FS)https://msdn.microsoft.com/en-us/library/bb897402.aspx
Microsoft Azure ADhttps://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-federation-saml-idp
Google IDPhttps://support.google.com/a/answer/6087519?hl=en
Oktahttps://www.okta.com/topic/saml/


Checklist external IDP


Prerequisites:


  • IDP must support SAML 2.0
  • client browser needs network access to IDP


Setup steps

  1. Customer provides Start URL e.g https://<IDP-URL>/adfs/ls
  2. Customer provides Public X.509 certificate file
  3. Policy Passport sets up a client account and configures to use the customer's IDP. Once setup the metadata of Policy Passport will be sent to the customer 
  4. Customer imports the Policy Passport metadata and configures SAML attributes that Policy Passport requires. 
  5. Customer tests the access to Policy Passport
  6. If successful, Policy Passport deactivates the access via username / password. 


Attribute Mapping


Please ensure that the name of every SAML 2.0 attribute exactly matches the name Policy Passport SP expects. 


NameFormatExampleComment
emailAddressurn:oasis:names:tc:SAML:2.0:attrname-format:urijohn.doe@customer.com


For Microsoft ADFS we provide custom rule mappings, see https://compliance.freshdesk.com/support/solutions/articles/12000059870-sso-with-adfs


Example SAML message


<saml2:AttributeStatement>
    <saml2:Attribute FriendlyName="emailAddress" Name="emailAddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
          john.doe@customer.com
          </saml2:AttributeValue>
   </saml2:Attribute>
</saml2:AttributeStatement>

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article