Document toolboxDocument toolbox

Configuring the PowerConnect Cloud Web UI for Single Sign On

Owned by Ben Bramley
Aug 20, 2023

Overview

The PowerConnect Web UI can leverage single sign for user logins and role mapping. Any provider supporting SAML should work however the functionality has been tested with:

  • Okta

  • Google Workspace

Configuration

In order to configure SAML integration with PowerConnect Cloud three pieces of information are required:

  • Assertion Consumer Service URL (ACS URL) - this is the URL where the PowerConnect Cloud agent is accessed by your SAML provider to initiate the login with /saml/login appended to it e.g. https://powerconnect-cloud-host/saml/login

  • Identity Provider URL (IdP URL) - this is the SAML provider URL

  • Identity Provider Certificate - this is the certificate of the SAML provider

Follow the instructions from your authentication provider to get these values. An Okta example is provided below.


Configuring Okta

  • Login to the Okta console

  • In the menu on the left click Groups under the Directory header

     

  • Click Add Group and create a group for each of the PowerConnect Cloud roles - Administrator, Inputs Manager and Outputs Manager

  • In the menu on the left click Applications

     

  • Click Create App Integration and choose SAML 2.0

     

  • Click Next

  • Give the application a name (e.g. PowerConnect Cloud) and click Next

     

  • Fill out the details in the form:

    • Single sign-on url - this should be the url of the PowerConnect Cloud UI with /saml/login appended to it

    • Audience URI - this should be PowerConnect Cloud

    • Application username - this can be set to the email address attribute or the user id attribute of the user in Okta

       

  • Create the attribute mappings - this maps the user attributes in Okta to the user attributes in PowerConnect Cloud

  • Create the Group Attribute mappings - this maps the Okta Groups to the PowerConnect Cloud Roles. Make sure the filter matches the group names you created previously

  • Fill out the Feedback form and click Finish

  • Under Sign On copy the Metadata URL for your newly created app

     

  • Open the URL in your web browser

    • Copy the contents of the X509Certificate xml element - this will be used in the certificate setting in the PowerConnect Cloud UI

       

    • Copy the conents of the SingleSignOnService element - this is the IdP url setting in the PowerConnect Cloud UI

       

  • Add any users you wish to have access to the PowerConnect Cloud UI using the Assignments tab and clicking Assign → Assign to People

Configuring SAML support in PowerConnect Cloud

  • Login to the PowerConnect Cloud Web UI

  • Click on the Configuration tab and then click Authentication

     

  • Under the SAML section check the Enable SAML checkbox to enable the SAML integration

  • Fill out the details from your SAML provider

    • The ACS URL is the PowerConnect Cloud UI URL with /saml/login appended to it

    • The IdP URL is the url of the SAML provider - in Okta it can be found in the XML metadata data collected in the section above

    • The IdP Certificate is the base64 encoded certificate of the SAML provider - in Okta it can be found in the XML metadata data collected in the section above

  • Perform the group mapping to map the PowerConnect Cloud groups you created in your SAML provider to the local groups that exist in the PowerConnect Cloud software

  • Click Save

  • User’s that are added to the PowerConnect Cloud SAML groups can now login from the PowerConnect Cloud login screen by clicking the Login using Single Sign On link