Skip to content

Single Sign-On (SSO)

This section describes the SAML instance where NorthStar CCM is the service provider (SP) and uses 3rd party identity providers (IdP).

Set up

Set up SAML

This set up applies to both Enterprise and Portal Websites.

To set up NorthStar CCM service provider SAML with 3rd party IdPs, step through the following process:

  1. Access the Enterprise Website. Login as an enterprise user and go to the Admin Settings page and access the SSO under Sysinternals.
  2. Select Setup Enterprise SSO or Setup Portal SSO based on which website you want to enable SSO for.
  3. Select SAML 2.0 as SSO Type.
    • Enter the IdP Login URL to set up IdP (identity provider). Use HTTPS. The Login Url is used when a user attempts to login. NorthStar CCM triggers a redirect to the URL and expects a POST request with the SAML Assertion Response on the SAML Assertion Consumer endpoint, /Security/ConsumeSAMLToken. In response, the NorthStar CCM service provider produces an NorthStar CCM access token for the assertion subject and redirects the now authenticated user to NorthStar CCM homepage.
    • Optionally, you can provide a Logout URL.
    • Provide the X.509 public key certificate in PEM format from the IdP. This establishes a trust relationship between the SP and the IdP. During runtime NorthStar CCM uses the certificate to validate that the digital signature originated from the IdP.
  4. Once ready, select Next to proceed with the Users Mapping configuration. Select Add new mapping to map fields within NorthStar CCM.
    • Select the available user profile fields from the drop-down list and then,
    • Enter in the related empty field, the correspondent Identity Provider attribute issued for mapping.
  5. Once ready, select Save and continue. In the last step, a notification will inform you about the SSO connection if it was successful or not. To ensure that the Single Sign-On is set correctly, select the Login now using SSO button. You will be redirected to the Identity Provider sign in page. Log in to the IdP website.
  6. Once ready, in the SSO Wizard, select Finish to save the changes.

Set up WS-Federation

To set up NorthStar CCM service provider WS-Federation with 3rd party IdPs, step through the following process:

  1. Access the Enterprise Website. Login as an enterprise user and go to the Admin Settings page and access the SSO under Sysinternals.
  2. Select Setup Enterprise SSO or Setup Portal SSO based on which website you want to enable SSO for.
  3. Select WS-Federation as SSO Type and proceed with the SSO Configuration Wizard:
    • IdP Login URL: Enter the URL associated with logging in to the Identity Provider address. Login URL is used when a user attempts to login with SSO. NorthStar CCM triggers a redirect to the URL and expects a POST request. In response, the NorthStar CCM Platform produces an NorthStar CCM access token for the assertion subject and redirects the now authenticated user to the NorthStar CCM Homepage.
    • IdP Logout URL: Optionally, you can provide a logout URL from your Identity Provider. This will validate the request to the IdP.
  4. Once ready, select Next to proceed with the Users Mapping configuration. Select Add new mapping to map fields within NorthStar CCM.
    • Select the available user profile fields from the drop-down list and then,
    • Enter in the related empty field, the correspondent Identity Provider attribute issued for mapping.
  5. Once ready, select Save and continue. In the last step, a notification will inform you about the SSO connection if it was successful or not. To ensure that the Single Sign-On is set correctly, select the Login now using SSO button. You will be redirected to the Identity Provider sign in page. Log in to the IdP website.
  6. Once ready, in the SSO Wizard, select Finish to save the changes.

Portal

NorthStar CCM uses the information asserted in the SAML Assertion to identify the portal user. Additionally, NorthStar CCM can keep certain parameters up to date, for e.g. updating the last name of the portal user in NorthStar CCM service provider by reading the SAML Assertion last name attribute received from the IdP.

To enable this behavior, you can map parameters to be linked with certain NorthStar CCM portal user fields when you setup SSO.

Creating NorthStar CCM Portal Users on the fly

If the SAML assertion subject is not associated with any NorthStar CCM portal user then the NorthStar CCM service provider will create a portal user.

Using SSO API

In some scenarios you might not want to use the URL redirection behavior provided by the SAML Assertion Consumer endpoint. For e.g., if you want to use SSO in a backend to backend system to obtain a session token in order to produce documents for a certain user. In this case, use Authorization.GetTokenSSO endpoint and pass the SAML Assertion to get an NorthStar CCM enterprise/portal session token which can be used throughout the Enterprise/Portal API.

SSO API Reference