Skip to main content

SSO Configuration

Single Sign-On | SSO | SAML 2.0 | Okta | Microsoft Entra ID

S
Written by Sergey Bayrachny

A user with a Manager role can configure the single sign-on (SSO) login for their organization. Currently, the SOC Prime Platform supports Okta and Microsoft Entra ID (Azure AD) as Identity Providers and SAML 2.0 as the sign-in method.

You can also map SAML groups from your Identity Provider to SOC Prime Platform roles, so that roles are assigned when users sign in through SSO. See SAML Group Mapping.

Once the SSO is configured, the Manager can make SSO login optional or required for their team.

How to Configure SSO with Okta

  1. Log in to Okta as an Administrator.

  2. Go to Applications > Applications and click Create App Integration.

  3. In the modal that appears, select SAML 2.0.

  4. In the General Settings section, fill in the App Name field and click Next.

  5. In the Configure SAML section:

    1. Fill in the Single sign-on URL and Audience URI (SP Entity ID) fields using the values from the SOC Prime Platform > Account icon > Platform Settings > SSO Configuration.

    2. In the Name ID Format field, select the EmailAddress option.

    3. Do not modify any other fields.

  6. In the Feedback section, select the I'm an Okta customer adding an internal app option and click Finish.

  7. Your app integration has been created. Now, add people who will be able to use single sign-on on the SOC Prime Platform (you can do it later).

  8. Go to the Sign On tab > Settings > SAML 2.0 and click More Details. Copy the following values under Metadata details and paste them on SOC Prime Platform > Account icon > Platform Settings > SSO Configuration:

    • Copy the value of Issuer and paste it into the Issuer field on the SOC Prime Platform.

    • Copy the value of Sign on URL and paste it into the Single Sign-On (SSO) URL field on the SOC Prime Platform.

    • Copy the Signing Certificate and paste it into the Public x509 certificate field on the SOC Prime Platform.

  9. Finish the SSO configuration on the SOC Prime Platform:

    1. Click the Save Changes button to save your configuration.

    2. Click the Test button to validate your configuration. It's very important to test the configuration since enabling SSO with wrong parameters may result in your entire team, including you, being unable to authenticate.

    3. Set the SSO login rules for your entire team:

      • Enable for users. When enabled, the users from your team will be able to choose between SSO and other authentication methods.

      • Enforce SSO login. When enabled, the SSO will be the only authentication method for all users on your team. Any logged-in users with other authentication methods will be logged out (including you). Once you've enabled the Enforce SSO login switch, click Test to test the configuration. If the test has been successful, the Save Changes button becomes available.

Note:

If you encounter any issues, contact us via support@socprime.com.

To learn more about SAML app integrations, see Okta's documentation.

How to Configure SSO with Microsoft Entra ID

  1. Log in to your Microsoft Entra ID as an Administrator and go to Enterprise Applications (you can type Enterprise Applications in the search bar and select the corresponding suggestion).

  2. Click the New application button.

  3. Click Create your own application.

  4. Give your application a meaningful name, keep the choice Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

  5. The application is created. Go to Single sign-on to configure it.

  6. Select SAML as the single sign-on method.

  7. Configure Basic SAML Configuration and Attributes & Claims.

    1. Click Edit in the Basic SAML Configuration box.

      1. Fill in the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) fields using the values from the SOC Prime Platform > Account icon > Platform Settings > SSO Configuration

        1. Identifier (Entity ID) – copy the value of the Audience URI (SP Entity ID) field on the SOC Prime Platform

        2. Reply URL (Assertion Consumer Service URL) – copy the value of the Single sign-on URL field on the SOC Prime Platform

      2. Click Save.

    2. Click Edit in the Attributes & Claims box. Set the values for Required claim and keep the default values for Additional claims:

      1. In Required claim set Source attribute to the mapping field for the emails used for registration on the SOC Prime Platform configured in your Microsoft Entra ID.

        Note

        The field used for email mapping is specific to your configurations in Microsoft Entra ID.

      2. In Additional claims keep the default values.

  8. Go to Users and groups to add users who'll be able to use SSO.

  9. Download the Certificate (Base64).

  10. On the SOC Prime Platform > Account icon > Platform Settings > SSO Configuration, fill in the following fields:

    1. Issuer – copy the value of the Microsoft Entra Identifier field

    2. Single Sign-On (SSO) URL – copy the value of the Login URL field

    3. Public x509 certificate – copy the Certificate (Base64) you've downloaded on a previous step

  11. Finish the SSO configuration on the SOC Prime Platform:

    1. Click the Save Changes button to save your configuration.

    2. Click the Test button to validate your configuration. It's very important to test the configuration since enabling SSO with wrong parameters may result in your entire team, including you, being unable to authenticate.

    3. Set the SSO login rules for your entire team:

      • Enable for users. When enabled, the users from your team will be able to choose between SSO and other authentication methods.

      • Enforce SSO login. When enabled, the SSO will be the only authentication method for all users on your team. Any logged-in users with other authentication methods will be logged out (including you). Once you've enabled the Enforce SSO login switch, click Test to test the configuration. If the test has been successful, the Save Changes button becomes available.

      Note:

      If you encounter any issues, contact us via support@socprime.com.

SAML Group Mapping

SAML group mapping allows a Manager to map identity provider groups to SOC Prime Platform roles and set a priority for each mapping. After the mappings are configured and saved, the platform assigns the mapped role when a user signs in through SSO, so role assignment follows the group structure in your identity provider.

Group mapping is available for Okta and Microsoft Entra ID.

Group mapping is evaluated when a user signs in through SSO. It applies only if the user currently has the company default role.

Note: SSO group mapping does not continuously synchronize user roles with your identity provider. Once a mapped role is assigned, subsequent changes to the user's groups will not update their platform role automatically. To apply mapping again, first assign the company default role to the user.

Before you begin:

  • Prepare your groups in your identity provider. Configure your identity provider to send group information to SOC Prime, and add users to the groups you plan to map.

    Okta

    1. In the Okta Admin Console, go to Applications > Applications and open the SAML app you created for SOC Prime. If you haven't created it yet, see How to Configure SSO with Okta.

    2. Go to the Sign On tab.

    3. In the Attribute statements section, click Show legacy configuration, and then click Edit.

    4. In Group attribute statements, fill in the fields as follows:

      • Name – groups

      • Name format – Unspecified

      • Filter – Matches regex and .*

    5. Save the changes.

    Then add users to all the groups you plan to map: go to Directory > Groups, open the group, and on the People tab click Assign people.

    Microsoft Entra ID

    Make sure the users are added to the groups you plan to map. You can do this in Groups > All groups, or on the Active Directory server level, depending on how your environment is set up.

    If you haven't set up SSO yet, see How to Configure SSO with Microsoft Entra ID.

  • Make sure the platform role you want to assign exists. If you need a new role, on the SOC Prime Platform, click the Account icon > Platform Settings > Roles. For details, see this guide.

  • Make sure the users you want to map currently have the company default role. For this, on the SOC Prime Platform, click Account icon > Platform Settings > Team Management and do one of the following:

    • Assign the default role to an existing user. Find the user in the list and change their role to the company default role.

    • Invite a new user with the default role. Click Invite User, enter the user's email, select the default role, and send the invitation.

Add a group mapping:

  1. On the SOC Prime Platform, click the Account icon > Platform Settings > SSO Configuration.

  2. Select Add Mapping.

  3. Fill in the fields:

    • SAML group name – The full name of the group as it appears in Okta or Microsoft Entra ID. Matching is case-insensitive, but spaces, hyphens, and other characters must match.

      To find the group name:

      • Okta: Go to Directory > Groups.

      • Microsoft Entra ID: Go to Groups > All groups.

    • SOC Prime platform role – The role that is assigned to eligible users who belong to the specified identity provider group.

    • Group priority – The priority of this mapping. If a user belongs to several mapped groups, the platform assigns the role of the group with the higher priority. Priority 1 is the highest.

  4. Select Next Step. The mapping appears in the Group Mappings list.

  5. Click Save Changes to activate the mappings.

After you save the changes, the mappings apply to subsequent SSO sign-ins.

To edit or delete a group mapping, click Edit or Delete on the group record, save the changes or confirm the action.

Related Articles
Did this answer your question?