Security Assertion Markup Language (SAML) Single Sign-on (SSO) is an Extensible Markup Language (XML) standard that allows a user to log on once for affiliated but separate Web sites. In this article, we will go over how to use the SAML Single Sign-on(SSO) feature within the Mvix CMS.
What You’ll Need:
- IDP access
- Mvix CMS Access
General Steps
- Go to the profile settings. If the SSO feature is enabled for your account, then there will be an option for using SSO (as shown in the image).
- Toggle the switch on and click on SSO (Single Sign-On) for a dialogue box showing several URLs needed for your specific IDP configuration (OneLogin, Clearlogin, Okta, Bitium etc.).
- Next, go to your Identity Provider’s website (OneLogin, Clearlogin, Okta etc.) and login as Administrator. From here, either use your existing SAML app, or create a new SAML app and provide the details as required.
*Check the methods of adding apps to your IDP below, prior to moving to the next step*.
After the creation of the app, the IDP will produce a metadata file or link to that SAML app to register it on the Service Provider end (cms.mvix.com). Navigate back to the Profile Settings page on the Mvix CMS, and input the metadata details in the correct SSO dialogue boxes. Now, select your login method via the “Login via” toggles:
- Both: All of your client users can log in from xhibitsignage.com as well as from IDP.
- Only SSO: All of your client users can log in through IDP only.
- Individual: If the client admin wants to set up SSO for a few client users only.
If you have selected the individual option from the above option, there will be a switch for each client user that can be turned on to enable SSO for that particular user. A client admin can enable SSO for the user so that he/she can log in through their respective IDP dashboard, and the rest of the users can continue to login through cms.mvix.com as usual.
Configure your new SAML SSO app on your IDP account further as needed.
Setting up SAML for IDP’s
One Login
To set up a SAML app for one login, please follow the steps below.
- Navigate to *yourcompanyname*.onelogin.com.
- Log in as an administrator in your account by entering your credentials into the login page.
- After login, you will be redirected to the dashboard.
- The dashboard will list all apps that you have created for your users. From here, you can edit apps and reconfigure them as needed.
- Navigate to the Administration page.
- Click on the navbar and select Applications. Then, “Add app” if you are creating a new app or select any available from the library to edit.
- Find your preferred SAML connector by searching. We recommend SAML Custom Connector (Advanced) provided by OneLogin.
- Adjust the settings to create your app.
- Change the name of the app to your desired name.
- Change the icon of the app to your desired icon.
- Select the save button at the top right side of the screen.
- Click on the configuration tab on the left and enter the details from the CMS as seen above:
- Place Audience Data in the Audience field.
- Place Consumer Data in the Recipient and Consumer URL field (not the Consumer URL Validator field).
- Place the Single Logout URL in the corresponding field.
- Place “.*” in the ACS (Consumer) URL Validator field.
- Navigate to the parameters section.
- Click on the “add parameter” button and write Email in the field. Select Email from the “Value” dropdown and accept the toggle for “Include in SAML Assertion”. Then, Save.
- Navigate to the SSO section and copy the Issuer URL.
- Click on the Save button at the top right side of the screen.
- You should now see your created app in your app library.
Back to your CMS Profile
- Navigate back to the profile settings page of https://cms.mvix.com/org/account-settings.
- Paste the issuer URL into the metadata link field as you can see in the image below.
- Select any of the “Login Via” option buttons according to your usage or access level for your client users.
- Both allow the use of the SSO login via your IDP app or via the standard email and password.
- Only SSO ensures all Users are only able to log in via your IDP app.
- The individual allows you to choose per user which login method they need to utilize.
- Click on the enable button to successfully register the app with the CMS. The app will register with the SP (cms.mvix.com). Otherwise, it will display an error.
- For SSO to work successfully, a client user should have an account on the Service Provider (cms.mvix.com) as well as on the IDP (onelogin) with the exact same email ID. The SSO feature should be enabled for that client user in cms.mvix.com. They should have access to the SAML app that you have created on IDP for integrating the Mvix CMS login.
- You can assign the app to the user on the IDP by navigating to the Users section & Adding or Selecting the user whom you want to assign to the app.
- If the User does not yet exist in the IDP Users list, apply them via the Users tab on the top left menu bar (as seen in the above images).
- If the User already exists, assign them to the Application via the application tab on their left side. Assign them to your created CMS app and ensure their Email (Attribute) value matches the email as assigned to the CMS exactly.
- You can also manage Users on the App level if you wanted to manage their settings once applied to the app via the Users page.
Testing Login
- Navigate to *yourcompanyname*.onelogin.com and login as a user whom you have enabled the SSO feature for.
- A dashboard will appear with the app icon on the screen. Click on that app icon and it will log you in as the client user into their cms.mvix.com account.
If you would like the Mvix Client Success Team to handle SAML setup on your behalf, please contact your Solutions Consultant for pricing on our paid Implementation Assistance service.
Problems, Questions, Corrections: If you have any further questions, problems, or corrections you would like to see made, please open a support ticket.
