Set Up Single Sign-On (SSO) using SAML

Refer to the following instructions to set up single sign-on (SSO) using SAML [ Settings ➔ SAML]:

Permissions

Only Admin can configure SAML. See user permissions.

Configuring SAML Metadata

Bitsight SAML Service Provider (SP) Details

Configure your identity provider (IdP) based on the following details:

Configuring Multiple Providers

To configure multiple providers:

1. Contact Bitsight Support to have the “Multiple SAML IdP” feature enabled.
2. Disable the “Auto provision users” toggle.

Once the feature is enabled, you’ll be able to add alternate providers.

Required Attributes

The following attributes from your identity provider are required:

• 'mail' (Email Address)
• 'cn' (First Name)
• 'sn' (Last Name)

These attributes should be configured on your identity provider using one of the following naming conventions (SAML 1.1 or SAML 2.0).

SAML 1.1

SAML 2.0

Optional SAML 2.0 Attributes

Additional attributes that can be specified:

• Full Name
• User Role
• User Group

Full Name

This can be specified in place of the last name field if the user’s name is not of the form, “Firstname Lastname.”

User Role

This specifies the user’s role in the Bitsight platform or their more specific role for the Bitsight VRM and Trust Management Hub (TMH) applications. This field is optional (in which case the user’s role will be a standard user role, or left unchanged). Otherwise, it must be one of these strings:

Bitsight platform roles:

• Customer User
• Customer Admin
• Customer Group Admin
• Customer Portfolio Manager
• None

VRM-TMH roles:

• Default Shared Roles
  • VRM Admin
  • VRM Operations
  • VRM View Only
  • None
• Default VRM Roles
  • VRM Internal Business User
• Default TMH Roles
  • TMH Access Only Operations
  • TMH Access Only Sales

User Group

This specifies the user’s group. If the group does not already exist, it will be created (and will initially be empty). If this is not specified, then the default group is used.

Enabling SAML

After you’ve submitted your SAML metadata, you can enable SAML by toggling the “Enable Configuration” option.

Once SAML is enabled:

• A URL appears at the top of the “Your SAML Login URL” page, which will contain either:
  • An SP-initiated (Service Provider-initiated) URL by default.
  • An IdP-initiated (Identity Provider-initiated) URL if a custom login URL is configured.
• Users will have to log in using the single sign-on (SSO) URL provided in the SAML page.
• A cookie is set each time a user first logs in.
• Once an Admin has successfully logged in using SAML, their password is disabled. Other Admins may keep accessing the platform with their credentials until they also log in via SAML.
• And the first time an admin successfully logs in, existing passwords are disabled for non-Admins.