Some common instructions for single sign-on - Identity as a Service

This topic describes the common instructions for single sign-on (SSO).

To implement SSO, you must first complete the SSO configuration.

You must configure the following common SSO settings for every application:

SSO status
Application account
Authorized scope

For detailed configuration steps, see the topic that corresponds to your application template type:

Application template type	Protocol	References
Pre-integrated templates in the application marketplace	SAML 2.0	3. Create an application
Standard protocol - SAML	SAML 2.0	Configure SAML 2.0 SSO
Standard protocol - OIDC	OIDC	Configure OIDC SSO
Self-developed applications	OIDC	Configure SSO for a self-developed application

SSO status

After an application is activated, all of its features are disabled. To make configuration easier, the frontend automatically changes the SSO status to Enabled. You must still click Save for the change to take effect.

An application for which SSO is disabled is not displayed in the user portal.

Application account

An application account is the identifier of a user in an application. When a user initiates SSO to an application, IDaaS passes the application account to the application. The application then sets the account to the logged-on state, which completes the SSO.

Therefore, if the application has existing accounts, check whether these accounts can be mapped to the accounts in IDaaS. If they cannot be mapped, batch synchronize or manually create accounts for users in the application in advance.

For SAML applications, you can configure the application account rules in the application. For more information, see Configure SAML accounts.

For OIDC applications or self-developed applications, IDaaS passes the relevant values in id_tokn. For more information, see OIDC id_token custom field configuration

Authorized scope

This setting defines the range of users who can access the application. The following two options are available:

Option	Description
All users can access	All accounts in IDaaS can access the application. No additional authorization is required.
Manual authorization	You must manually assign the organizations and accounts that can access the application on the Application Authorization tab of the application. For details, see Identity as a Service:Authorization.