Single Sign-on Best Practices

[saikanumuri]

Title

Single Sign-on Best Practices

Short Description

As SSO setup is key while starting the IGA Journey. This document provides an overview of the best practices while configuring the SSO to offer a seamless experience to the end users.

Applicable version

2023.3 & Later

Detail best practice

Customers often choose to integrate single IDP and multiple IDPs to achieve various use cases.

General guideline 

1. Before enabling SSO ensure all URLs (SP and IDP) are available and can be reached from Saviynt Servers. In order to not get locked out of environment if the SSO configuration is incorrect.
2. When using a singed certificate to sign the SAML communication ensure all certificates within the certificate chain are imported into the keystore.
3. Ensure a unique user attribute is used for the SAML subject and the correct NameIDFormat is specified. This will help avoid unwanted authentication errors.
4. Always keep EntityId unique across the environments. This will help avoid incorrect configuration mapping.
5. Always exchange the saml metadata files over a secure communication channel as it contains certificates and other sensitive information.

Single IDP Setup

1. Saviynt provides a default certificate with an expiration of up to 5 years. In order to sign saml request, Saviynt default certificate can be used.
2. Ensure the attribute configured in the user lookup property is unique in Saviynt to avoid login issues.
3. Ensure the Max authentication session configured is always equal to or greater than the IDP session timeout.
4. Ensure to have enough time buffer defined in the Response Skew by comparing the time difference between the Saviynt and IDP server
5. Ensure the user has at least an end-user sav role assigned so that the endusers don't run into access issues in Saviynt even if authentication/SSO is successful
6. The option to validate SAML assertion signature should be enabled (default is no). If not enabled, Saviynt will not validate the digital signature by IDP and this can lead to security vulnerability where message integrity can not be validated.
   
   Multiple IDP Setup
   
   Below are a few additional points that needed to be kept in mind for MultipleIDP setups while all the points stated in the single IDP setup are still applicable. 
   
   

1. After enabling multiple IDP additional screen shows up where user has to make a selection. In case you want to provide some information to the user then the label on the screen can be updated
2. For multiple IDP lookup field option, the user attribute (custom property) with the idp name should be updated. The update of user attribute can be automated by making use of inline processing for Saviynt.
3. Be mindful that In case of both the username and IDP from the dropdown are selected, the dropdown always takes precedence.

Reference documentation (doc portal link)
https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter06-EIC-Configurations/Config...