MindSalt uses OpenID Connect (OIDC) to let users sign in through an organization's identity provider instead of maintaining a separate MindSalt password.
Open Security settings #
Browse to Admin System Preferences Settings Security.
Notice: Coordinate this work with the identity-provider administrator. System administrators can always use their local MindSalt login, even after SSO is enforced, so they can restore access if the SSO integration fails. Test that local login before configuring or changing SSO.
Gather the MindSalt values #
- Open Admin, System, then Security.
- Find the Single Sign-On section.
- Copy the displayed Login / Redirect URL.
- Record the SSO ID if your sign-in process or provider setup uses it.
- Leave SSO enforcement off until testing is complete.
Create the identity-provider application #
Create an OIDC web application in the identity provider. Configure it with:
- the MindSalt Login / Redirect URL as an allowed sign-in redirect URI,
- an issuer or base identity-provider URL,
- a client ID,
- and a client secret.
Restrict access to the users or groups who should be able to sign in to MindSalt.
For an Okta example, see Configure single sign-on with Okta.
Enter the provider values in MindSalt #
- Turn on Use SSO for logins.
- Enter Base IdP (Issuer) URL.
- Enter Client ID.
- Enter Client Secret.
- Select Save.
Test before enforcement #
- Assign a non-administrator test user to the identity-provider application.
- Open a private or incognito browser window.
- Start the MindSalt SSO sign-in flow.
- Complete identity-provider authentication.
- Confirm that the correct MindSalt employee is signed in and can reach the expected screens.
- Sign out and repeat the test once more.
Warning: An incorrect issuer, client ID, client secret, redirect URI, or user assignment can prevent SSO sign-in. Do not enforce SSO until the end-to-end test succeeds.
Protect administrator local passwords #
System administrators keep local MindSalt login access so they can recover the account if the identity provider or SSO integration is unavailable. Each administrator should use a unique local password or passphrase that:
- is at least 16 characters long;
- includes letters, numbers, and special characters;
- is not reused for another account; and
- is stored in a trusted password manager.
Test at least one administrator's local login before enforcing SSO and after changing sign-in settings.
Enforce SSO #
After the test user can sign in:
- Return to the MindSalt Security settings.
- Select Enforce the use of SSO for logins (prevent the use of local accounts).
- Save.
- Confirm sign-in with a normal user.
- Sign in with a system administrator's local MindSalt credentials to confirm that recovery access still works after enforcement is enabled.
Rotate credentials or disable SSO #
Coordinate changes with the identity-provider administrator. Add or replace the client secret, save, and test before retiring the old credential. Before disabling SSO enforcement, verify that affected users can receive or reset a local MindSalt password.