Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Easy heading
linkText4
linkText10
linkText3
linkText6
linkText5
relatedLinksLabels
linkText2
linkText1
headingTagsH1,H2,H3
sidebarMaxHeight450
linkType2Page
linkType3Page
linkType1Page
linkType10Page
sidebarTitleON THIS PAGE
linkUrl3
linkUrl4
linkUrl1
linkUrl2
linkUrl10
includedPageModeDisable_Included_Pages
linkText8
linkText7
relatedLinksOrderLabels_First
sidebarModeOpened
headingNumberingModeDisable_Numbering
linkText9
sidebarMarginRight20
relatedLinksTargetNew_Window
relatedLinksTitleRELATED LINKS
linkUrl9
linkUrl7
linkUrl8
numberedHeadingTagsH1,H2,H3
linkUrl5
linkUrl6
linkType8Page
linkType9Page
linkType6Page
headingLinkTextModeWrap
linkType7Page
linkType4Page
linkType5Page
sidebarWidth240
sidebarTop160
headingLinkExpandModeCollapse_All_By_Default
headingLinkIndent10

...

By the end of this manual, you will have successfully integrated your Identity Provider with GYTPOLSaaS, marking a significant milestone in enhancing your organization's security infrastructure. Let's embark on this journey together, towards a more secure and efficient digital environment.

Anchor
_n3baf0dl398y
_n3baf0dl398y
Prerequisites for Integration

Before you begin the integration process of your Identity Provider (IdP) with GYTPOL SaaS, it's essential to have everything in place for a smooth and successful setup. This section outlines all the necessary prerequisites to ensure that you are fully prepared. Please ensure that you have the following before proceeding:

...

Familiarity with Your IdP's Configuration Process: While this manual will guide you through the general steps for integration, IdPs can vary significantly in their specific configuration processes. Having a basic understanding of how to navigate and make changes in your IdP will be beneficial. If you're unfamiliar, consider reviewing your IdP's documentation or reaching out to their support team for guidance.

Anchor
_nylgd3lh7yww
_nylgd3lh7yww
Step-by-Step Integration Guide

Anchor
_dg7ku8spk6fw
_dg7ku8spk6fw
Azure AD

Anchor
_6hvwpk7vd80q
_6hvwpk7vd80q
Add Amazon Cognito as an enterprise application in Azure AD

In this step, you add an Amazon Cognito user pool as an application in Azure AD, to establish a trust relationship between them.

Anchor
_2v8v334poj6j
_2v8v334poj6j
To add new application in Azure AD

  1. Log in to the Azure Portal.

  2. In the Azure Services section, choose Azure Active Directory.

  3. In the left sidebar, choose Enterprise applications.

  4. Choose New application.

  5. On the Browse Azure AD Gallery page, choose Create your own application.

  6. Under What’s the name of your app?, enter a name for your application and select Integrate any other application you don’t find in the gallery (Non-gallery), as shown in Figure 1.

  7. Choose Create.

After creating the application in Azure AD, it may take a few moments for the process to complete. Once finished, you will be automatically redirected to the Overview page for the newly added application.

Please note that there is a possibility of encountering a Not Found error during this step, even if Azure AD has successfully created the new application. In such cases, you can navigate back to Enterprise applications in Azure AD and search for your application by its name to locate it.

Anchor
_utpf0zrtv9jk
_utpf0zrtv9jk
To set up Single Sign-on using SAML

  1. On the Getting started page, in the Set up single sign on tile, choose Get started, as shown in Figure 2.

  2. Proceed to the next screen and select SAML.

  3. In the middle pane, navigate to the Basic SAML Configuration section, and click on the edit icon.

  4. In the right pane, within the Basic SAML Configuration, replace the default Identifier ID (Entity ID) with the Identifier (Entity ID) provided by your account manager. Then, in the Reply URL (Assertion Consumer Service URL) field, input the Reply URL provided by your account manager, as depicted in Figure 3. Click on Save to confirm the changes.

  5. In the middle pane under Set up Single Sign-On with SAML, in the User Attributes & Claims section, choose Edit.

  6. Choose Add a group claim.

  7. On the User Attributes & Claims page, in the right pane under Group Claims, select Groups assigned to the application, leave Source attribute as sAMAccountName, as shown in Figure 4.

  8. Expand the Advanced options mark the “Customize the name of the group claim” checkbox. Write “groups” in the Name field, as shown in Figure 4 and Choose Save. This will allow automatic GYTPOL roles mapping to Azure AD groups.

  9. Scroll down to the SAML Signing Certificate section and copy the App Federation Metadata URL by choosing the copy into clipboard icon (highlighted with red arrow in Figure 5).

  10. Please send the URL to your account manager.

  11. Assign the application to the relevant groups.

Anchor
_sj8wbm2igucc
_sj8wbm2igucc
Okta

Anchor
_mtb4z6701vv3
_mtb4z6701vv3
Configure SAML integration for your Okta app

Create a new App Integration and select SAML 2.0

...

  1. Under General Settings, enter a name for your app.

  2. (Optional) Upload a logo and choose the visibility settings for your app.

  3. Choose Next.

  4. Under General, for Single sign on URL, enter the Single sign-on URL provided by your account manager (as Reply URL) and Audience URI (SP Entity ID) which was also provided by your account manager,as shown in Figure 2.

...

Under Attribute Statements (optional), add a statement with the following information, as shown in Figure 3:

Name

Value

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

user.email

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

user.lastName

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

user.firstName

...

  1. For all other settings on the page, leave them as their default values or set them according to your preferences.

  2. Choose Next.

  3. Choose a feedback response for Okta Support.

  4. Choose Finish.

  5. Open the application and under the Sign On page, copy the Metadata-URL and send it to your account manager, as shown in Figure 4.

Anchor
_j196whyi9n3l
_j196whyi9n3l
Assign a user to your Okta application

  1. On the Assignments tab for your Okta app, for Assign, choose Assign to People.

  2. Choose Assign next to the user that you want to assign.
    Note: If this is a new account, the only option available is to choose yourself (the admin) as the user.

  3. Choose Save and Go Back. Your user is assigned.

  4. Choose Done.

Anchor
_jb1co5orqnkl
_jb1co5orqnkl
Troubleshooting and Support

Once your account manager confirms that the configuration is complete on our end, you can proceed to log in to your application. Simply click on the name of the provider on the login page to initiate the login process.

...

Anchor
_vc2p8utf84b7
_vc2p8utf84b7
Login loop

To troubleshoot, open the developer tools by either pressing F12 or right-clicking on the page and selecting "Inspect".

...

In our example, the reason for the loop may be due to the absence of the email statement. (The image example is from Okta).

...

Anchor
_ozcopqinus8
_ozcopqinus8
Groups to GYTPOL roles does not work

When automatic mapping fails, it typically indicates that the IdP did not send the groups in the SAML response.

...

  1. Proceed with the login process. Then, click on the row labeled "token".

  2. Navigate to the Preview tab. Copy the value of the id_token.

  3. Visit https://jwt.io/ in your browser and paste the copied value into the provided field.

  4. In the decoded part, check if there is a "custom:groups" field in the payload.

  5. If the "custom:groups" field is missing, ensure that the IdP groups claim or statement is configured correctly.

    In Okta, this may involve double-checking the filter (explanation on Regex filtering). In AzureAD, verify if groups are configured to sAMAccountName and ensure that the claim name is correct.

Anchor
_a1tyzel8a6jb
_a1tyzel8a6jb
FAQs

Anchor
_wm230rxfvyuz
_wm230rxfvyuz
I've set up a role using an IdP group name, and users can successfully log in. However, when I check the role, it doesn't display any members.

Correct. Upon user login, the groups are included in a JWT sent to the backend. We then map the user's group to GYTPOL Roles internally. As a result, the user will have the permissions associated with the role but will not be listed as a member of the role.

Anchor
_jc52rkr4evx2
_jc52rkr4evx2
My IdP does not supply Metadata URLs and only allows me to download the file, what should I do?

Download the file and send it to your account manager without making any edits. We'll take care of the rest.

Anchor
_regfemps847m
_regfemps847m
I want to add a user from my IdP to a role I created but I don’t see the user in the dropdown.

Correct. For GYTPOL to register the user in the database, the user needs to log in to the system first. After that, you'll be able to see them in the dropdown menu.

Anchor
_9721be8bywd2
_9721be8bywd2
Can users be created automatically in GYTPOL once we assign the application to them?

No, unfortunately we do not currently offer support for SCIM.

Anchor
_b1os91p0qbp9
_b1os91p0qbp9
I was assigned the application and was able to login, how ever I am seeing a blank screen

This situation occurs when there are roles configured in the GYTPOL application, but you haven't been assigned to any role.

Anchor
_pudjlic4mlam
_pudjlic4mlam
When attempting to access the application from the application tile, you're encountering an error message indicating "Invalid samlResponse" or "relayState" from the identity provider.

We do not support IdP initiated logins, only logins initiated from GYTPOL are accepted.