Skip to main content
Versa Networks

Configure Single Sign-On for Titan Portal

  1. Last updated
  2. Save as PDF

Versa-logo-release-icon.pngFor supported software information, click here.

Single sign-on (SSO) is a session and user authentication service that allows a user to use a single set of login credentials to access multiple applications. The service authenticates all the applications for which the user has the required rights and eliminates further authentication prompts when the user switches applications during the same session. On the backend, SSO logs user activities and monitors user accounts. Titan Portal allows a service provider (SP) to offer single sign-on as a login mechanism to different integrators and clients.

You can enable SSO authentication when you create a new customer by selecting the external SSO authentication option. Note that you can enable only one authentication method at a time, either external SSO authentication or two-factor authentication. After you enable SSO authentication, you must create an SSO profile for the user.

When you configure a Titan SSO profile, you choose to allow users with one of the following options:

  • All IdP user—An external identity provider (IdP) authenticates and authorizes the user, and then Titan Portal proceeds with access for the user. You do not need to create a local user in Titan database, but the user must exist in the IdP database.
  • Titan-known user only—An external IdP authenticates the user, and Titan authorizes the same user in the Titan database and proceeds with access. An administrator adds local users to Titan database before creating an SSO profile. When you create Titan-known users only, even if the user exists in the IdP database, Titan does not provide access to the user if the user is not a local user. Then, you need to add a local user using the external option in the Add User window to provide access to the Titan dashboard.

For SSO, Titan Portal supports Security Assertion Markup Language (SAML), an XML-based, open standard data format for exchanging authentication data and authorization data between an IdP and a service provider.

Titan Portal enables IdP-based and local user authentication.

Titan Portal supports two types of SSO:

  • SP-initiated SSO—Allows you to access the Titan Portal when you click the Login with Single Sign-On link on the Titan Portal login page. This page redirects you to the IdP page for authentication and then redirects you to the Titan Portal.
  • IdP-initiated SSO— Allows you to access Titan Portal after authenticating on the customer's portal and redirects you directly to the Titan Portal.

Titan Portal SSO has been tested with the ADFS, Azure AD, G-Suite, Okta, and OneLogin IdPs.

To configure SSO on Titan Portal, you do the following:

  1. Configure Titan Portal SP-initiated or Titan Portal IdP-initiated SSO.
  2. Configure an IdP.
  3. Access the Titan Portal using SSO.

SAML-Based Authentication

Security Assertion Markup Language (SAML) is a common standard for authenticating and authorizing users so that they can access multiple services and applications. SAML is a common standard for exchanging authentication between a service provider (SP) and an IdP, and it is most commonly used for web browser–based SSO. SSO authenticates a user once and then communicates that authentication to multiple applications. Using SAML-based SSO in Titan Portal improves the user experience, because users do not have to enter their credentials frequently.

Configure SAML-Based SSO using Okta

An SP-initiated SSO flow operation is started from the SP and is performed in the following sequence:

  1. The SP server creates an authentication request and redirects you to the IdP.
  2. The IdP requests your credentials, validates you, and redirects you to the SP with the login response.
  3. The SP validates the login response and logs you in if the validation is successful.

An IdP-initiated SSO flow operation is started from the IdP and is performed in the following sequence:

  1. Create an SSO response.
  2. Redirect you to the SP with the login response.
  3. The SP validates the login response and provides access to the requested resource if the validation is successful.

Configure SP-Initiated SSO

To create SP-initiated SSO using Okta, you do the following:

  • Create an application on Okta.
  • Add users to the application.

Create an Application

To create a SAML connection application:

  1. Create an account in Okta.
  2. Log in to Okta with your credentials.
  3. In the left menu bar, select Applications > Applications.
  4. Click Create App Integration to create a new SAML connect application.

    okta-application1.png
     
  5. In the Create a New App Integration window, click SAML 2.0, and then click Next.

    okta-application-app-integration.png
     
  6. In the General Settings > App name field, enter an Application name, and then click Next.

    okta-application-create-saml-integration.png
     
  7. In the Configure SAML page, enter information for the indicated fields.

    okta-application-general.png
     
    Field Description
    Single Sign-On URL Enter the URL to which Okta sends OAuth responses.
    Audience URI (SP Entity ID) Enter the SP entity ID.
    Name ID Format Select the name identifier format supported by the IdP. 
    Attribute Statements

    Enter the following attributes and their values:

    • Director role
    • External ID
    • First name
    • Last name
    • Idle timeout
    • Name ID
    • Role
    • Organization
    • Two-factor status
  8. Click Next.
  9. In the Feedback page, select Customer or Partner, and then click Finish.

    okta-application-feedback.png
  10. In the left navigation bar, select Applications > Applications and click the newly created SAML application.

    okta-application-created.png
  11. Select the Sign On tab, and then click View SAML Setup Instructions.

    okta-application-sign-on.png
    Make a note of the single sign-on URL and IdP issuer information, and download the certificate file. You use this information while configuring the SSO profile in Titan Portal.

    okta-single-sign-on-url.png

Add Users to an Application

  1. In the left navigation bar, select Applications > Applications and then click the newly created SAML application.

    okta-application-created.png
     
  2. Select the Assignments tab, click the Assign drop-down list, and then click Assign to People.

    okta-application-assign1.png
  3. Select a person and then click Assign.

    okta-application-assign2.png
  4. In the Assign to People popup window, click Save and Go Back.

    okta-application-assign3.png
  5. Click Done.

Configure an SSO Profile in Titan Portal for Okta

You can enable SSO authentication while creating a new customer by selecting the external SSO authentication option. After you enable SSO authentication, you must create an SSO profile for the user.

To create an SSO profile in Titan Portal:

  1. Log in to Titan Portal.
  2. In the Settings menu, click Single Sign-On.

    single-sign-on.png
     
  3. In the Single Sign-On popup window, enter information for the following fields.

    single-sign-on-page.png
     
    Field Description
    SAML Name Enter a name for the SSO profile.
    Display Name Enter a display name for the SSO. This is displayed when you login with SSO.
    Name ID

    Select a name identifier for the IdP:

    • Email Address
    • Persistent
    • Transient
    • Unspecified
    IdP Certificate Click Browse File icon, and then upload the certificate generated by the IdP while creating the SAML application in Okta.
    Single Sign-on URL Enter the SAML SSO URL generated by the IdP while creating the SAML application in Okta.
    Issuer Enter the URL of the issuer of the certificate.
    Allow Users

    Choose the type of user:

    • All IdP user—An external IdP authenticates and authorizes the user, and then Titan Portal proceeds with access for the user.
    • Titan-known user only—An external IdP authenticates the user, and then Titan authorizes the same user in Titan database and proceeds with access.
    Enabled Click to enable or disable the SSO authentication profile.
  4. Click Save.

To edit, view, or delete an SSO profile from the SSO profile list:

single-sign-on-page-action.png

  • Click the edit-icon.pngEdit icon to update an SSO profile.
  • Click the eye-icon.pngEye icon to view an SSO profile.

    view-sso-profile.png
     
  • Click the delete-icon.pngDelete icon to delete an SSO profile.

Access Titan Portal Using SP-Initiated SSO

If you have enabled the SSO Enabled option in the Edit SSO window, the Titan Portal login page displays the Login with Single Sign-On link.

To access Titan Portal using SSO:

  1. On the Titan Portal login page, click Continue with Single Sign-On (SSO).

    sso-login-page.png
     
  2. In the popup window, enter the organization name, and then click Next.

    sso-login-org-name.png
     
  3. In the IdP (Okta) login page, enter your credentials and click Sign In.

    sso-idp-sign-in-okta.png
  4. IdP validates your credentials and then displays the Titan Portal home page.

Configure SAML-Based SSO Using Azure AD

Prerequisites

To configure SAML-based SSO authentication using Azure AD, you need the following:

  • A Microsoft Entra user account.
  • An enterprise application configured on Aure AD.
  • The user account must be assigned to an enterprise application.

To create an enterprise application for SSO and assign the user account to the application, contact your Azure administrator.

Configure SAML-Based SSO Using Azure AD

  1. Log in to the Microsoft Azure portal using the Microsoft Entra credentials.
  2. In the Microsoft Azure Home screen, click Enterprise Applications.

    azure-home-page.png
  3. In the search box, enter the application name, and then select the application. For example, Titan-Test-AAD.

    search-application.png
  4. In the left menu bar, select Manage > Single sign-on. The following screen displays.

    manage-sso-saml.png
  5. Click SAML. The following screen displays.

    setup-sso-saml.png
  6. To generate a SAML certificate, click Edit in the SAML Certificates section. The certificate needs to be uploaded while creating the SSO profile in Titan Portal.

    setup-sso-saml-certificate.png
  7. In the SAML Signing Certificate screen, click + New Certificate. 

    saml-signing-certificate.png
  8. The certificates that you created are listed in the SAML Certificates section with active download links. Click the download link for Certificate (Raw), and save the certificate file in the .crt format.

    saml-signing-certificate1.png
  9. In the Set up section (here, Set up Titan-Test-AAD), copy and keep the values for the Login URL and Microsoft Entra Identifier fields. You will need these to create the SSO profile in Titan Portal.

    setup-titan-test-aad.png

Configure an SSO Profile in Titan Portal for Azure AD

You can enable SSO authentication while creating a new customer by selecting the external SSO authentication option. After you enable SSO authentication, you must login as an enterprise administrator to create an SSO profile for the user.

Note: The Single Sign-On option is available only if your organization supports external SSO authentication. If the Single Sign-On option is not available, contact Versa Networks customer support.

To create an SSO profile in Titan Portal:

  1. Log in to Titan Portal.
  2. In the Settings menu, click Single Sign-On.

    settings-sso.png
  3. In the Single Sign-On window, enter information for the following fields.

    configure-sso.png
     
    Field Description
    SAML Name (Required) Enter a name for the SSO profile.
    Display Name (Required) Enter a display name for the SSO. This is displayed when you login with SSO.
    Request Binding (Required) Select HTTP-Redirect.
    Name ID (Required)

    Select the name identifier for the IdP to Email Address
    IdP Certificate (Required) Click the Browse File icon, and then upload the certificate generated by the IdP while creating the SAML application in Azure AD. The certificate file must be in .crt, .cert, or .pem format.
    Single Sign-on URL (Required) Enter the SAML SSO URL (Login URL) generated by the IdP while creating the SAML application in Azure AD.
    Issuer (Required) Enter the Microsoft Entra ID generated by the IdP while creating the SAML application in Azure AD.
    Allow Users

    Select All IdP Users.
    Enabled Click the toggle to enable or disable the SSO authentication profile.
  4. Click Save.
  5. To edit, view, or delete an SSO profile from the SSO profile list:
    • Click the Edit icon to update an SSO profile.
    • Click the Eye icon to view an SSO profile.
    • Click the Delete icon to delete an SSO profile.

      edit-sso-profile.png
  6. Click the  Eye icon, and then click the SP Metadata URL link and save the file as an XML file. You need to upload the file in the SAML SSO application in the Azure AD portal.

    view-sso-profile1.png

Configure SAML SSO Attributes and Upload Metadata File in Azure AD Portal

You must configure the attribute parameters and upload the SAML metadata file that you downloaded in Configure an SSO Profile in Titan Portal for Azure AD, above.

Upload a Metadata File

To upload a metadata file in Azure AD portal:

  1. Go to the Microsoft Azure Home screen, and browse to your enterprise application page.
  2. In the left menu bar, select Manage > Single sign-on.
  3. In the Set up Single Sign-On with SAML screen, click Upload metadata file.

    upload-metadata-file.png
  4. In the Upload metadata file window, click the Browse icon and upload the XML file that you downloaded in Configure an SSO Profile in Titan Portal for Azure AD, and then click Add.

    upload-metadata-file1.png

    After the metadata file is uploaded, the Basic SAML Configuration section displays the identifier and reply URL values fetched from the metadata file.

    basic-saml-config.png

Configure SAML SSO Attributes

To configure SAML SSO attributes in Azure AD portal:

  1. Go to the Microsoft Azure Home screen, and browse to your enterprise application page.
  2. In the left menu bar, select Manage > Single sign-on.
  3. In the Attributes and Claims section, click Edit.

    attributes-section1.png
  4. To add an attribute value, in the Attributes and Claims screen, click each attribute value in the Value column in the Additional claims section.

    attributes-edit1.png
     
    Field Description
    Unique User Identifier (Name ID)

    Enter the unique user identifier as follows:

    • user.userprincipalname
    Director Role

    Enter the Versa Director role associated with your organization that you want to assign to the user:

    • TenantDashboardAdmin
    • TenantSuperAdmin
    • TenantOperator
    • TenantSecurityAdmin
    External ID

    In the Manage Claim screen, enter information for the following fields.
     

    manage-claim.png


    view-sso-profile-ext-id.png
    First Name

    Enter the first name as follows:

    • user.givenname
    Last Name

    Enter the last name as follows:

    • user.surname
    Mail

    Enter the mail as follows:

    • user.mail
    Organization

    Enter the organization name. The organization name is case sensitive.

    • organization

Add Users to an Application

To add users to an application:

  1. Go to the Microsoft Azure Home screen, and browse to your enterprise application page.
  2. In the left menu bar, select Manage > Users and Groups.
  3. In the Users and Groups screen, click Add user/group. The Add Assignment screen displays.

    add-user-group-home.png
  4. Click None Selected. The users and groups list displays to the right.

    add-assignment.png
  5. In the Users and groups section:
    1. Select the All tab.
    2. Select the user to add. You can use the search bar to search for users.
    3. Click Select. The Add Assignment screen displays the number of users selected.

      add-assignment-users-groups.png
  6. Click Assign. The selected user is added to the application.

    add-assignment-users-groups-added.png
  7. To view the user added to the application, click Refresh in the Users and groups home page.

    users-groups-refresh.png

Create Users and Assign User Roles in Titan Portal

If you need to add many users, use the Import Users option to upload user information with the user platform set to External. For more information, see Manage Users.

To add a new user:

  1. Select Users in the left menu bar.
  2. In the Users dashboard, click + Add User.

    add-user.png
  3. In the Add User window, enter information for the following fields.

    add-user1.png
     
    Field Description
    First Name Enter the user's first name.
    Last Name Enter the user's last name.
    Email Address Enter an email address for the user. This automatically becomes the login name for the account. You can change the email address after creating the account, but not the login name.
    Phone Number Select the country code, and then enter the phone number. 
    External Select External to have the authentication request sent to the external IdP when the user logs in to Titan Portal. Users created using the External option are not created in the Titan database.
    Role

    Select the role to assign to the account:

    • Enterprise Admin
    • Enterprise User 
  4. Click Create.

Access Titan Portal Using SSO

If you have enabled the SSO Enabled option in the Edit SSO window, the Titan Portal login page displays the Login with Single Sign-On link.

To access Titan Portal using SSO:

  1. On the Titan Portal login page, click Continue with Single Sign-On.

    sso-login1.png
     
  2. In the popup window, enter the organization name, and then click Next.

    sso-login2.png
     
  3. To access your Azure AD login page, click the SAML display name. If you are already logged into your Microsoft account in the same browser, you are automatically logged into Titan Portal.

    sso-login3.png
  4. The IdP validates your credentials, and then displays the Titan Portal home page.

Supported Software Information

Releases 11.3 and later support all content described in this article.

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Page type
    Topic
    Product
    Titan
  2. Tags
    This page has no tags.