Single sign-on with SAML 2.0
Sign in to INSIDE through your organisation's SAML identity provider using website-specific single sign-on settings.
What it is
Single Sign-On with SAML 2.0 lets your organisation's identity provider authenticate operators before they enter INSIDE. Powerfront configures the provider separately for each website.
The returned identity must contain an email address that INSIDE can use to find or create an operator account.
Who uses it and why
Operators use their organisation's sign-in process. Administrators decide which accounts should use single sign-on. Developers and identity administrators work with Powerfront to supply provider settings and test access.
Where to find it
Operators use Sign In with SSO on the configured sign-in page or follow the provider redirect during sign-in.
Powerfront manages Settings › Account › Single Sign-On. Ask Powerfront to configure or change the provider. Users with the Settings role and operator permissions, or the Manager role with Edit Operator SSO, manage individual Single Sign-On selections under Settings › Account › Operators.
How it works
- Start sign-in through your website's configured single sign-on entry.
- INSIDE redirects you to the SAML provider.
- Complete the provider's authentication steps.
- The provider returns a signed response. INSIDE checks it against the configured certificate and reads your email address.
- INSIDE finds your operator account and applies its account and website checks before opening the console.
If the account does not exist, automatic operator creation may create it for activation. This needs a configured template and must be allowed by the website's single sign-on settings.
Configured IP Ranges can reject a sign-in from an unlisted network. A disabled or inactive INSIDE account still needs activation even if provider authentication succeeds.
Configure it
Give Powerfront your provider's SAML SSO URL and signing Certificate, and agree the website and browser or app flows to support. Powerfront can enable single sign-on, select SAML 2.0, configure network restrictions and set a Remote Logout URL.
Ask Powerfront to turn on Enforce SSO for all Operators to enable SSO for existing client operators whose default website is the configured website. An authorised account manager can subsequently set an individual exception by turning that account's Single Sign-On off. Managers need Edit Operator SSO for that change.
Check new accounts and accounts added from other websites separately. The enforcement action is not a substitute for reviewing each account's sign-in selection.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Enable | Settings › Account › Single Sign-On | website | Off | Powerfront | Enable the configured single sign-on provider for this website. |
| SSO Type | Settings › Account › Single Sign-On | website | SAML 2.0 | Powerfront | Select SAML 2.0 or OAuth 2.0 for the website's single sign-on flow. |
| SAML SSO URL | Settings › Account › Single Sign-On | website | Not set | Powerfront | Set the identity-provider destination used to begin SAML sign-in. Not set means no provider destination is configured. |
| Certificate | Settings › Account › Single Sign-On | website | Not set | Powerfront | Supply the certificate used to validate the provider's signed SAML response. Not set means SAML sign-in cannot validate the response. |
| Remote Logout URL | Settings › Account › Single Sign-On | website | Not set | Powerfront | Redirect operators to this destination after single sign-on logout. Not set means no remote logout redirect is configured. |
| IP Ranges | Settings › Account › Single Sign-On | website | Not set | Powerfront | Restrict the configured single sign-on flow to the listed network addresses or ranges. Not set means no network restriction from this setting. |
| Enforce SSO for all Operators | Settings › Account › Single Sign-On | website | Off | Powerfront | Turning this on enables Single Sign-On on existing client operator accounts whose default website is this website; individual exceptions can be set afterwards. |
| Single Sign-On | Settings › Account › Operators | operator | Off | Settings role, Manager role | Direct this operator's sign-in to the website's configured provider when single sign-on is enabled. |
Permissions
| Permission | Lets you |
|---|---|
| Settings | Manage permitted operator accounts, subject to Settings Permissions. |
| Operators | Allow operator administration within Settings Permissions. |
| Manager | Manage permitted operator accounts, subject to Manager Permissions. |
| Edit Operator SSO | Allow a manager to change an operator's Single Sign-On selection. |
Limits and good to know
- The provider must return an email address. Provider sign-in alone does not create website access for an existing account.
- Your local operator roles and permissions still determine what you can do in INSIDE.
- Single sign-on accounts are exempt from INSIDE's local password-expiry check.
- Signing out can redirect to Remote Logout URL. Without it, INSIDE returns to its single sign-on landing page.
- Browser, operator-app and manager-app return flows differ. Test each one your team uses with Powerfront.
Depends on and works with
View all connections as a list
This feature uses
- Operator accountsConfigured by
Each operator has a Single Sign-On selection and account activation state.
- Roles and permissionsConfigured by
Delegated permissions control who can edit operator SSO selections.
- Website, channel and subsite accessConfigured by
Local website access still applies to federated operator accounts.
- Login and email verificationRequires
Provider authentication still leads to INSIDE operator-account admission checks.
- Logout and remembered computersRelated
Provider sign-in opens an operator session, and logout follows the configured provider destination.
- SSO operator creation and activationEnhances
A provider identity can create a missing operator when automatic creation is configured.
- Operator sign-in network and email restrictionsConfigured by
Single sign-on network restrictions and new-operator email-domain policy can prevent access.
Used by
- Operator accountsEnhances
Single sign-on can replace password-based access.
- Login and email verificationEnhances
SAML single sign-on can direct an operator to an identity provider.
- Password changes and recoveryRelated
SAML users manage their provider password separately and are exempt from local password expiry.
- Logout and remembered computersConfigured by
SAML settings supply the remote logout destination when one is configured.
- SSO operator creation and activationConfigured by
For SAML, website Single Sign-On settings select the creation template, notification and activation message.
- Certificates and protected browser dataConfigured by
SAML federation has its own certificate configuration managed by Powerfront.
- Operator sign-in network and email restrictionsConfigured by
SAML sign-in has a separate IP Ranges list managed by Powerfront.
FAQ and troubleshooting
Why did provider authentication succeed but INSIDE deny access?
Check whether the INSIDE account is active, has the required website access and is using an allowed network. A new account may be awaiting activation.
What does a missing certificate message mean?
Powerfront needs to configure the signing certificate for your website. Ask Powerfront to check Certificate.
Why does INSIDE report that no email was found?
The provider response may be invalid or may not contain a usable email address. Ask your identity administrator and Powerfront to check the response mapping and certificate.
Can one operator be exempt from SSO?
An authorised account manager can turn off the individual Single Sign-On selection after website enforcement has been enabled.
Who changes the SAML provider settings?
Powerfront changes the Single Sign-On screen for you. Your identity administrator supplies the provider details.