Managing single sign-on (SSO)
The Flex Appliance Console supports single sign-on (SSO). Note the following prerequisites and considerations:
To use SSO, you must have a SAML 2.0 compliant identity provider configured in your environment.
Only identity providers that use AD or LDAP directory services are supported.
SSO users cannot use the APIs. API keys are used to authenticate a user and therefore cannot be used with a SAML-authenticated user.
SSO users must use the fully qualified domain name (FQDN) in the URL to access the Flex Appliance Console. For example, https://consoleFQDN. The IP address option does not work for SSO.
Single logout (SLO) is supported if an SLO POST binding URL is present in the identity provider (IDP) metadata. If it is not present, you sign out only from the appliance and not from the IDP. In this situation, Cohesity recommends that you close your browser after signing out for security purposes.
Note:
For some IDPs with SLO, you are not redirected to the sign-in page after you sign out of the console. Open a new session to sign back in.
Perform the following steps to configure SSO.
To configure SSO
- Add the SSO identity provider (IDP).
See Adding an IDP.
- From the Single sign-on page, select the check box next to Enable single sign-on to enable SSO.
- Import the SSO users that you want to have access to the Flex Appliance Console.
Use the following procedure to enable or disable SSO. You must have added at least one IDP.
To disable or enable SSO
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click Single sign-on.
- Select or deselect the check box next to Single sign-on.