Overview
Learn about SSO & SAML for Lenses authentication.
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
This page describes configure SSO & SAML in Lenses for authentication.
This page describes configuring Okta SSO for Lenses authentication.
Lenses is available directly in Okta’s Application catalog.
SAML configuration is set in HQ's config.yaml file. See here for more details.
This page describes configuring Azure SSO for Lenses authentication.
Learn more here about
This page describes configuring Google SSO for Lenses authentication.
Google doesn't expose the groups, or organization unit, of a user to a SAML app. This means we must set up a custom attribute for the Lenses groups that each user belongs to.
Open the from an administrator account.
Click the Users button
Select the More dropdown and choose Manage custom attributes
Click the Add custom attribute button
Fill the form to add a Text, Multi-value field for Lenses Groups, then click Add
Learn more about
The attribute values should correspond exactly with the names of groups created within Lenses.
Open the from an administrator account.
Click the Users button
Select the user to update
Click User information
Click the Lenses Groups attribute
Enter one or more groups and click Save
Learn more about
Open the from an administrator account.
Click the Apps button
Click the SAML apps button
Select the Add App dropdown and choose Add custom SAML app
Run through the below steps
Enter a descriptive name for the Lenses installation
Upload a
This will appear in the Google apps menu once the app is enabled
Given the base URL of the Lenses installation, e.g. https://lenses-dev.example.com, fill out the settings:
| Setting | Value |
|---|
Add a mapping from the custom attribute for Lenses groups to the app attribute groups
From the newly added app details screen, select User access
Turn on the service
Lenses will reject any user that doesn't have the groups attribute set, so enabling the app for all users in the account is a good option to simplify ongoing administration.
Download the Federation Metadata XML file with the Google IdP details.
This page gives an overview of SSO & SAML for authentication with Lenses.
Control of how user create with SSO is determined by the. There are two modes:
Manual
SSO
With manual mode, only users that pre-created in HQ can login.
With sso mode, users that do not already exists are created and logged in.
Control of how a user's group membership should be handled in relation to SSO is determined by the . There are two modes:
Manual
SSO
With the manual mode, the information about the group membership returned from an Identity Provider will not be used and a user will only be a member of groups that were explicitly assigned to them in HQ.
With the sso mode, group information from Identity Provider (IdP) will be used. On login, a user's group membership is set to the groups listed in the IdP.
Groups that do not exist in HQ are ignored.
SAML configuration is defined in the config.yaml provided to HQ. For more information on the configuration options see .
The follow SSO / SAML providers are supported.
This page describes configuring OneLogin SSO for Lenses authentication.
Identifier (Entity ID) | Use the base url of the Lenses installation e.g. https://lenses-dev.example.com |
Reply URL | Use the base url with the callback details e.g. https://lenses-dev.example.com/api/v2/auth/saml/callback?client_name=SAML2Client |
Sign on URL | Use the base url |
ACS URL | Use the base url with the callback path e.g. https://lenses-dev.example.com/api/v2/auth/saml/callback?client_name=SAML2Client |
Entity ID | Use the base url e.g. https://lenses-dev.example.com |
Start URL | Leave empty |
Signed Response | Leave unchecked |
Name ID format | Leave as UNSPECIFIED |
Name ID | Leave as Basic Information > Primary Email |
This page describes configuring Keycloak SSO for Lenses authentication.
SAML configuration is set in HQ's config.yaml file. See here for more details.
Client ID
Use the base.url of the Lenses installation e.g. https://lenses-dev.example.com
Client Protocol
Set it to saml
Client Saml Endpoint
This is the Lenses API point for Keycloak to call back. Set it to [BASE_URL]/api/v2/auth/saml/callback?client_name=SAML2Client. e.g. https://lenses-dev.example.com/api/v2/auth/saml/callback?client_name=SAML2Client
Name
Lenses
Description
(Optional) Add a description to your app.
SAML Signature Name
KEY_ID
Client Signature Required
OFF
Force POST Binding
ON
Front Channel Logout
OFF
Force Name ID Format
ON
Name ID Format
Root URL
Use the base.url of the Lenses installation e.g. https://lenses-dev.example.com
Valid Redirect URIs
Use the base.url of the Lenses installation e.g. https://lenses-dev.example.com
Name
Groups
Mapper Type
Group list
Group attribute name
groups (case-sensitive)
Single Group Attribute
ON
Full group path
OFF
