Documentation forSolarWinds Observability SaaS

Configure Single Sign-On (SSO) via SAML

SolarWinds Observability SaaS supports single sign-on (SSO) via SAML 2.0 integration. SAML (Security Assertion Markup Language) is an industry standard used to provide SSO by authenticating against a particular identity provider (IdP). Users can log in to their Active Directory domain or intranet and have immediate access to SolarWinds Observability SaaS, without requiring additional log-in.

When SSO is enabled, organization members must authenticate against IdP, unless the user account is identified as a service account. Service accounts are allowed to log in with a separate username and password. See Set up service accounts.

Configure SAML

The Organization owner can configure SAML in the Security section of the SolarWinds Observability SaaS settings. Click Settings, select Organization Settings, and click the Security option to access the Security section.

configure-image

Integrate SAML

  1. Use the three SolarWinds URLs when configuring your Identity Provider (IdP) for integration with SolarWinds Observability SaaS.

  2. Use the Service Provider Certificate when configuring your IdP for integration with SolarWinds Observability SaaS.

    The Service Provider Certificate is used for SAML assertion encryption. This is optional and is configured on the IdP side. To configure SAML assertion encryption, copy the Service Provider Certificate from the text area and use it when configuring your IdP encryption.

    The certificate is not available until you configure SAML for your organization.

  3. Find the following information from the Identity Provider and enter it in the fields provided:

    • Issuer (Entity ID)

    • SAML URL

    • Single Logout URL (optional)

    • Identity Provider X.509 certificate, provided in a PEM format with a proper prefix and suffix. See example below.

  4. Save the configuration.

  5. Click the Enable SAML integration toggle. Organization members except the owner will be logged out of SolarWinds Observability SaaS.

    Organization members can log in either via the IdP or the dedicated login screen that is available from the login screen (see Log in with SSO credentials).

    For a member to be able to use IdP-initiated login, set the NameID attribute to user.email value. The member must be known to the provider and exist in SolarWinds Observability SaaS.

    If a user is removed from your IdP and removed from the list of service accounts (if applicable), the user's access to your organization and its data is removed. The user is still listed as a member of the organization in the Users screen of the Organization Settings but does not have access to your organization. See Remove a user from your organization for more information.

SSO configuration information for various identity providers

SSO configuration can vary between Identity Providers. The following list provides links to the appropriate IdP documentation:

When configuring your IdP, the following user attributes should be set:

  • givenname, givenName, firstname, or firstName: Optional. If set, it overwrites the first name set in the user's profile.

  • surname, surName, lastname, or lastName: Optional. If set, it overwrites the last name set in the user's profile.

  • NameID: Required if users will log in via the IdP's portal page. Value should be user.email

  • groups or Groups: Required only if setting up role mapping. Otherwise, do not use this attribute. See Set up role mapping.

Additional SAML integration information

If SAML integration is disabled, legacy users (those who existed in the organization before SAML was enabled) should use their original password to log in to the product. Users added after the integration will have to perform a password reset.

The Organization owner can invite new users known to the IdP into the SAML-enabled organization or use role mapping to grant immediate access all users in an IdP user group.

Set up role mapping

Role mapping allows you to define organization roles based on the account's IdP group membership. Members added to an IdP group automatically gain access to any organization role mapped to that group.

Users must have an organization role defined before they can log in to SolarWinds Observability SaaS. If role mapping is enabled, ensure all users are members of a group that is mapped to an organization role.

If a new user is added to a mapped IdP user group, a SolarWinds Observability SaaS user account will be created for the user automatically.

Organization owners cannot be defined via Role Mapping. See Manage Users for instructions detailing assigning the owner role to users manually.

Once role mapping is turned on, the user's organization roles will be updated to match the roles assigned via Role Mapping and permissions can only be changed in SAML settings. The organization role can still be modified manually in the Users area for Organization owners.

Organization roles previously set on a per-user basis will not be restored if role mapping is disabled.

To map roles to IdP group memberships:

  1. Update your IdP configuration so it sends the correct groups. Configure the SAML Assertion that is sent to SolarWinds Observability SaaS to send the IdP group to an attribute (claim) named groups or Groups.

    This configuration will vary depending on your IdP provider.

    This setting is required to map IdP groups to organization roles. If the groups membership is not configured correctly, you will see a "No SAML groups received" error.

  1. In the Security section of SolarWinds Observability SaaS, select the Role Mapping tab and click Enable Role Mapping.

  2. To map an organization role, select the field for the role you wish to map, type the ID of an identity provider group, and press Enter. For details about the Organization Roles, see User roles and access levels.

When role mapping is enabled or disabled, all organization members except the owner will be logged out of SolarWinds Observability SaaS.

Every time an organization member logs in to SolarWinds Observability SaaS, the organization's IdP is accessed and read.

Set up service accounts

With service accounts, users can log in to SolarWinds Observability SaaS with either their SAML login or their SolarWinds Observability SaaS user account's username and password. Organization owner accounts are automatically included as a service account.

To define a user account as a service account and allow the user options for how they log in, click the Service Accounts tab and type the user's email address in the Accounts field or select the user from the drop-down.

When all service accounts are defined, click Save.

If a user account was defined as a service account and is later removed from the IdP, their service account status will still allow them to access the organization. Remove the user account from the list of service accounts to ensure access to your organization is revoked.

Log in with SSO credentials

Click Log in with Single Sign On from the SolarWinds Observability SaaS login page, enter your organization email address, and click Log in with Single Sign On. If you are not already logged in to your identity provider, you will be prompted to log in with your identity provider. Once you are logged in, you can access all organizations that you are a member of. See SolarWinds Observability SaaS user account for more information.

When accessing SolarWinds Observability SaaS for the first time, new SAML users need to log in from the IdP's portal page. Click the link to SolarWinds Observability SaaS from your IdP's portal page to access the application. After this first access to SolarWinds Observability SaaS, you can log in from the IdP page or via the Log in with SSO link.

 

FAQs

What is SSO/SAML?

Single sign-on (SSO) is an authentication method that allows users to log in to several independent software systems with a single set of credentials. Security Assertion Markup Language (SAML) is a protocol used to configure and implement SSO. This (single) authentication is provided by an identity provider. Once the user is authenticated against the identity provider, they are automatically authenticated to use all configured services. This helps administrators manage users' access to multiple services and allows users to access multiple services without worrying about multiple login credentials.

In layman's terms, SSO/SAML allows users to access multiple software systems, including SolarWinds Observability SaaS, using their corporate login method.

When the term SAML is used in this document or in the software, it is referring to the SAML authentication method used by SolarWinds Observability SaaS to implement SSO.

What is an IdP?

IdP stands for identity provider, which is a service that stores and manages user accounts. Identity providers allow companies to securely manage access to their systems and data. SSO/SAML uses an identity provider to authenticate user accounts across multiple services.

Examples of identity providers include Microsoft Azure, Google, OneLogin, and Okta.

What are Organization Roles?

Organization Roles define the access users have to the organization’s settings and SolarWinds Observability SaaS resources.

  • Member roles have access to viewing the organization’s resources, but cannot modify settings related to the organization.
  • Admin roles can also manage the organization, its users, and the organization’s settings.
  • Owner roles can do anything a member or admin can do, but also are allowed to configure Security settings.

If a user or group is assigned to multiple roles, the role with the greatest access will be applied.

Why are my organization's users asking for me to create service accounts for them? Should I do it?

Service accounts allow users to log in to SolarWinds Observability SaaS with a username and password instead of using the SAML-authentication method you have set up. Whether or not you create a service account for a user depends on the following:

  • Do you need to audit user access to a product? Disallowing service accounts allows you to audit login access from one location: your IdP.

    Organization owners can log in without SAML, so you may still need to track their non-SAML logins.

  • How much manual user management and support are you willing to perform? Creating a service account for users means paying attention to which users can log in with only SAML versus those that can log in via either SAML or username and password. Also, when revoking a user's access to SolarWinds Observability SaaS, you need to remove them from both the IdP and the list of service account users. If a user is no longer a member of an IdP but has a service account defined, they still can access SolarWinds Observability SaaS.

  • Do you need to grant users not in your company's IdP access to your SolarWinds Observability SaaS organization? Creating a service account for that user would allow these users to log in to SolarWinds Observability SaaS without authenticating against your company's IdP.

  • Does your user access multiple organizations? If the Organization owners for each of their organizations allow them to log in with the SolarWinds Observability SaaS user credentials, the user can log in once to access all of their organizations.

What happens if I remove a user from my organization's IdP?

If a user leaves your organization and is removed from your IdP, the user's access to your organization and its data is revoked. However, if the user was defined as a service account, their service account status will still allow them to access the organization. Remove the user account from the list of service accounts to ensure access to your organization is revoked.

While the user's access to your organization and its data is revoked, it is still listed as a member of the organization in the Users page of the Organization Settings but cannot access the organization. See Remove a user from your organization for more information.