Overview

About SSO and Federated Authentication

Single Sign-On streamlines user login access to multiple systems by allowing them to authenticate once and access various resources without repeatedly entering credentials. It balances user convenience and security, making it an essential tool for organizations seeking a seamless and secure user experience across their digital ecosystem.

Vega's SSO allows configuration using SAML.

SAML (Security Assertion Markup Language) and OpenID are two widely used protocols in the realm of authentication and authorization for Single Sign-On (SSO) systems.

SAML is a mature protocol that focuses on exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). When a user tries to access a service, the IdP generates a SAML assertion, containing the user's identity information and authentication status. This assertion is digitally signed and sent to the SP, which can then grant access based on the received information. SAML is commonly used in enterprise settings where a centralized IdP manages user identities and access to various services.

Getting Started

Vega Federated Authentication links your credentials to the Vega Platform. Vega implements authentication using the Federated Identity Management model.

When using the FIM model, your company manages your credentials using an Identity Provider (IdP). With its IdP, your company can enable you to authenticate with other services across the web. You configure the Vega Platform to authenticate using data passed from your IdP.

This goes beyond SSO as your IdP manages your credentials, not Vega. Your users can use the Vega Platform without needing to remember another username and password.

Required Role for Configuration

To manage SSO and Federated Authentication, you must have the Organization Owner" or Global Admin roles.

Procedure

IMPORTANT Two-Stage Configuration Depending on your Identity Provider, some circular logic may apply when linking it to a Service provider like Vega. To Link your IdP to Vega:

• Your IdP needs values from Vega and
• Vega needs values from your IdP. To simplify setup, Vega prompts you to enter placeholder values for the IdP and Vega configurations. You will replace these values later in the procedure

Configure An External Identity Provider Application

To configure Federated Authentication, you must have an external SAML IdP application. In the SAML IdP, you must perform the following:

1. Create a new application for Vega.

2. Configure initial SAML values for the new application.

3. Set placeholder values for the following fields:

   • SP Entity ID or Issuer
   • Audience URI
   • Assertion Consumer Service (ACS) URL

4. Set valid values for the following fields:

Field	Value
Signature Algorithm	Algorithm used to encrypt the IdP signature. Vega suports the following signature algorithm values: SHA-1 & SHA-256
Named ID	Valid Email Address Note: Name ID is both your email address and username

5. Create Attributes with the following Attribute Names for the following SAML Attribute Values:

SML Attribute Name	SAML Attribute Value
firstName	First Name
lastName	Last Name
email	User email
memberOf	User Groups

Note: The names of these attributes are case sensitive. Type these attribute names as shown in camelCase

6. Save these values.

Once you have completed the initial setup for your IdP application, you link the IdP to Vega to federate your users' logins.

Apply your Identity Provider to Vega

NOTE Prerequisite This procedure assumes you already have an external IdP application.

You configure Federate Authentication in Vega from the Single Sign-On Tab of the Settings Page.

1. Navigate to the Settings Page.
2. Click the Single Sign-On Menu Tab. You will see "Create a new SSO configuration".
3. Click "SAML" button, then click "Next" button.
4. Enter the following SAML Protocol Settings.

Field	Necessity	Description
Configuration Name	required	Human-readable label that identifies this configuration (Not Editable).
Configuration Display Name	required	Human-readable name that is displayed on the login page (Editable).
IdP Issuer URI	required	Identifier for the issuer of the SAML Assertion. NOTE: Specify a placeholder value for this field. Obtain the real value for this field from your IdP once you have supplied it with the Vega meta data.
IdP Single Sign-On Url	required	URL of the receiver of the SAML AuthN request. pecify a placeholder value for this field. Obtain the real value for this field from your IdP once you have supplied it with the Vega meta data.
IdP Signature Certificate	required	PEM-encoded public key certificate of the IdP. You can obtain this value from your IdP. You must paste the contents of the certificate into the text box.
Request Binding	required	SAML Authentication Request Protocol binding used to send the AuthNRequest. Can be either: - HTTP POST - HTTP REDIRECT
Response Signature Algorithm	required	Response algorithm used to sign the SAML AuthN Request. Can be either: - SHA-256 - SHA-1

5. Click Next

Configure your Identity Provider with Vega Meta Data

Having setup your IdP in Vega, you can provide the required Vega Metadata to your IdP.

1. On the Single Sign-On screen in Vega, click the *Download metadata to download the metadata required by your IdP. Vega provides this data as an .xml file.
2. Upload the metadata to your IdP. You now have the necessary information to replace the placeholder IdP Issuer URI and IdP Single Sign-On URL values set when you set up the initial IdP mapping in Vega.
3. In Vega, modify the placeholder values set for IdP Issuer URI and IdP Single Sign-On URL for the linked IdP with the proper values from your IdP.