Single sign-on lets employees use your organization's identity provider to sign in to MindSalt.

Understand the single sign-on settings #

Users can sign in to MindSalt using either MindSalt's built-in authentication or using a Single Sign-On (SSO) solution from a supported provider using OpenID Connect.

OpenID Connect is a simple identity layer on top of the Oauth 2.0 protocol. It allows applications to verify the identity of an end-user based on the authentication and authorization performed by an identity provider, such as OneLogin or Okta.

To help with configuration, below are step-by-step OpenID Connect configuration guides for well known SSO providers:

• Okta

Options and field descriptions #

Enable Single Sign-On (SSO) via OpenID Connect – This option enables or disables OpenID Connect SSO.

Base IdP URL – The unique base URL for your IdP. This value may also be called Issuer URL. MindSalt will verify this URL by looking for the well-known endpoint configuration using the base IdP URL provided (https://base-idp-url.com/.well-known/openid-configuration).

Client ID – The client ID provided by your IdP.

Client Secret – The client secret provided by your IdP.

Login / Redirect URL – This is your unique MindSalt login and redirect URL. Provide this URL in the appropriate location(s) in the OpenID Connect configuration within your IdP.

Enforce the use of SSO for logins (prevent the use of local accounts) – When selected, non-administrator users will only be able to sign in to MindSalt using their OpenID Connect credentials. While administrators may also sign in to MindSalt using their OpenID Connect credentials, their built-in MindSalt account credentials may also be used as a way to sign in on the MindSalt sign-in page. This is to prevent administrators from being locked out of MindSalt in the event the IdP is unavailable or there is an OpenID Connect configuration issue preventing logins.

Modifying Your System's OpenID Connect SSO Settings #

1. Browse to Admin, select System, and then select Security.
2. Enable OpenID Connect SSO by selecting the box for Enable Single Sign-On (SSO) via OpenID Connect.
3. Provide information in the spaces provided.
4. Select Save.

Configure and test single sign-on #

Coordinate these steps with the administrator for your identity provider.

1. Browse to Admin, select System, and then select Security.
2. Find the Single Sign-On section and copy the Login / Redirect URL.
3. Create an OpenID Connect web application in the identity provider.
4. Add the MindSalt Login / Redirect URL as an allowed sign-in redirect URI.
5. Copy the issuer URL, client ID, and client secret from the identity provider.
6. In MindSalt, turn on Use SSO for logins.
7. Enter Base IdP (Issuer) URL, Client ID, and Client Secret.
8. Select Save.
9. Test sign-in with a non-administrator in a private browser window.

Do not enforce SSO until the test user can sign in and open the expected MindSalt screens.

Enforce single sign-on #

System administrators keep their local MindSalt sign-in so they can recover the account if the identity provider is unavailable. Test at least one administrator’s local MindSalt sign-in before enforcing SSO.

After the test user can sign in:

1. Return to the MindSalt Security settings.
2. Select Enforce the use of SSO for logins (prevent the use of local accounts).
3. Select Save.
4. Confirm sign-in with a normal user.
5. Confirm that a system administrator can still use local MindSalt credentials.

An incorrect issuer URL, client ID, client secret, redirect URI, or user assignment can prevent employees from signing in.