Skip to main content

Plan a Safe SSO and SCIM Rollout

Single sign-on (SSO) lets members sign in to Verdictan through your identity provider, with OIDC or SAML 2.0. SCIM lets that provider create, update, and suspend members in Verdictan. This article gives the sequence that keeps owners able to sign in. SSO and SCIM gives the full procedure.

Prepare before you start​

Work with your identity provider administrator. In Verdictan, you need org:sso. For SCIM, you also need sso:read and sso:write. Get these items:

  • The email domain to verify for sign-in discovery
  • The provider values: an OIDC discovery URL, client ID, and client secret, or the SAML metadata
  • The roles and teams to give each directory group
  • A test user who is not an owner
  • Two different recovery owners who can sign in with a password

Do not make the only active owner your first SSO test user.

Follow the safe sequence​

  1. Create the connection in Settings → Single Sign-On. Then verify the email domain.
  2. Register the callback of your region at the identity provider. The Console of your region owns the callback.
  3. Select Test Connection, and correct each error.
  4. Sign in with the password of each recovery owner. Then record the break-glass activation with both owner IDs.
  5. Map directory groups to roles under Group-to-Role Mapping.
  6. Enable SSO, and test sign-in with the test user.
  7. Make SSO mandatory only after these tests are successful.

Break-glass access lets owners sign in when the identity provider is not available. Activation needs a passing connection test, a verified domain, and two different recovery owners. A passing metadata test does not prove sign-in.

Make SSO mandatory​

Enforcement turns off password sign-in for users in the configured domain. The assigned recovery method stays available.

If the identity provider fails, a recovery owner signs in with a password. Then the owner turns off SSO for all members. Do not use enforcement to find problems in a connection that you did not test.

Add SCIM​

The Console shows the SCIM token only one time. Copy it immediately, and keep it in the protected credential field of the identity provider. Keep the token out of email and tickets.

A SCIM group change does not remove the grants that come from other sources. After deprovisioning, also examine direct roles, owned tokens, active sessions, and owned resources.

Next steps​