Set Up Single Sign-On

Allow users to use their login credentials from an external service provider to log on to the solution.

You will need to configure your SAML 2.0 settings with an identity provider (IdP) before you can set-up single sign-on in the solution. Visier supports IDP-initiated single sign-on, so any IDP that supports SAML 2.0 can be used.

Step One: Set up single sign-on with your identity provider

Use the following information as guidance for configuring the SAML 2.0 assertion:

General settings

• Service Provider: Visier Analytics
• Service Provider Endpoint: https://vanityname.visier.com/VServer/auth

  Note: Replace vanityname with your vanity URL domain.

• Single Logout Endpoint (Optional): https://vanityname.visier.com/VServer/auth/logoffWithSaml

  Note:  

  • Replace vanityname with your vanity URL domain.
  • This is required to enable single logout (SLO). If your IdP does not have a distinct setting to enable SLO, you can enable SLO by providing the above URL. To disable SLO in this case, just remove the SLO URL. If your IdP does have a setting to enable SLO, you must enable the setting and provide the above URL.
• Unique identifier for users: The NameID attribute should be mapped to the username field in Visier. This is usually an email address.
• Secondary information to be passed to Visier pertaining to user accounts: Nothing specific to user accounts, but we need to know the Issuer URL for SSO to work.

Security settings

The assertion must be signed with one of the following algorithms:

• RSA-SHA256
• RSA-SHA1
• DSA-SHA1

Issuer and certificate information

• NameID format expected by Visier: Standard format. This should be the username field in Visier, which is usually an email address. For example, john.doe@acmeinc.com
• NameIDPolicy: Unspecified, transient.
• Type of SSO initiation: IdP Initiated.
• Creation of user accounts: User accounts can be loaded from a file or created manually. Auto-provisioning is also available. For more information, see Auto Provisioning.
• Deactivation of user accounts: Deactivate user accounts via the solution.
• Self-signed certificates: Supported.
• SAML single logout: Supported. If enabled, users who sign out of their IdP site are also signed out of Visier.
• Session timeout limit: Yes. This can be adjusted in the SAML assertion. The following is an example of a three hour session:
  Copy

  1
  2
  3
  4
  <saml2:SubjectConfirmationData NotOnOrAfter="2015-01-26T11:40:56.109Z" Recipient="https://vanityname.visier.com/VServer/auth"/>
  </saml2:SubjectConfirmation>
  </saml2:Subject>
  <saml2:Conditions NotBefore="2015-01-26T08:40:56.109Z" NotOnOrAfter="2015-01-26T11:40:56.109Z">

Step Two: Set up single sign-on in Visier

1. On the global navigation bar, click Settings > Single Sign-On.

2. In the Login URL box, type the URL that users will use to log on to the solution. This URL is generated by your SSO solution (IdP).
3. Optional: In the Logout URL box, type the URL that users will be directed to after they log out of the solution.
4. In the Certificate box, type the X509 certificate that was used to sign the SAML assertion. SAML assertions for the solution should be signed but not encrypted.
5. In the Issuer box, type the entity ID of the IdP. The issuer uniquely identifies the identity provider within the solution and should match what was provided as part of the assertion during sign-on events.
6. Optional: In the Parameters box, type any additional parameters required by the IdP. These parameters must be URL encoded.
7. Optional: Enable auto-provisioning to automatically create user accounts for new users who access the solution from your SSO portal. For more information, see Auto Provisioning.
8. Optional: To exclude specific users from SSO, add users to the Bypass Users list. Selected users can bypass SSO and use their existing username and password to log into Visier with the following URL: https://{vanity-name}.visier.com/VServer/auth/admin. To complete the login process, users will be asked to enter a verification code that is sent via email.
9. Click Save.
10. Click Test Login to test the login workflow.
11. Click Enable SSO.

Frequently asked questions

Is there a metadata file that can be consumed in our IDP to configure the integration?

No. There is no metadata file. However, the only Visier specific information needed to set up SSO with your identiy provider is the Service Provider Endpoint. You can find this in Studio by clicking Settings > Single Sign-On on the global navigation bar. The Service Provider Endpoint should be in the following format: https://vanityname.visier.com/VServer/auth

Is Just-in-Time (JIT) or SCIM provisioning supported?

Visier supports JIT provisioning. For more information, see Auto Provisioning. If auto provisioning is enabled, when a user attempts to sign into Visier, a user account will automatically be created for them if a username does not already exist matching the NameID sent. SCIM provisioning is not supported as a protocol, and users cannot be create automatically based on criteria defined in the IDP or elsewhere.

Is Multi-Factor Authentication (MFA) supported?

As an IDP-initiated connection, the sign in is initiated via the Identity Provider and any steps required by the end user as part of the authentication process is irrelevant from Visier’s perspective. Once any required steps are completed, the only requirement is that the IDP sends the SAML on to Visier.

Is a Sandbox/QA environment available to test the SSO integration prior to go-live?

No. We do not provide an environment for SSO testing. However, before you enable SSO, you can test the connection to confirm it is working as expected. When you set up single sign-on in Studio, click Test Login to test the login workflow. A new tab will open with a Visier icon, click the icon and it should log you in automatically. If successful, you can enable SSO to go-live.

How do users access Visier once SSO is set up?

When users navigate to the sign in page in their browser they will be seamlessly taken to the IDP to authenticate at the Login URLthat you defined. Once authenticated, users will be redirected by to Visier and signed in.

Once enabled can users only connect via SSO?

Exceptions can be made. For example, if you want to have a backup in case a certificate expires or there is an issue with the IDP. You may also have contractors that cannot be added to the IDP due to internal controls. In these cases, you can add users to the Bypass Users list when you set up SSO in Visier. Bypass users can sign in to Visier independent of SSO. They will be redirected to a different sign in URL, enter their credentials, and asked to enter a verification code that is sent via email.

How can I troubleshoot if a user cannot sign in via the IDP?

When a user attempts to sign in to Visier via SSO, and is unsuccessful, there are two potential outcomes.

If the user is redirected to a generic Visier page requesting the user’s username and password, the request was passed on to Visier successfully via the IDP, but the SAML contents do not match what Visier expects. For example, the NameID sent does not match a user’s username in Visier, or the certificate or issuer sent does not match the expected values defined in Visier.

If the user encounters an error, or is redirected to a non-Visier landing page, the issue is on the IDP-side. Either the user is not configured to allow access to Visier (in the wrong user group) or an incorrect Login URL was entered in Visier to support IDP-initiated connections.