Single Sign-On (SSO)

This topic explains how to set up and configure single sign-on in Rescale for your enterprise.

Single sign-on overview

Single sign-on (SSO) is a method for authenticating users where a single set of credentials can be used to log into several different applications. This is especially useful in a corporate setting, when you want your employees to be able to access a variety of applications using their company credentials.

Rescale Support of SSO

SSO authentication is available in all Organizations.

Setting Up Single Sign-On

Getting Started with Single Sign-On 

You must be an Organization Administrator in order to set up single sign-on. 

Note: SSO with Rescale applies at the Organization-level. All Workspaces will be able to authenticate with SSO once configured.

To configure single sign-on:

  1. From your Organization Administration, navigate to Security, and then click on the Single Sign-On tab
  2. Click the Configure Single Sign-On button to begin setup.
    WgW18n5mvwLSB32WICBP6P3wlylghJ8kcVX2ACTbMuA2WU D4sQsqlWOK02mWuIRZwiCmzWlR 

If you have configured SSO previously, click the gear icon to return to this form

  1. It is strongly recommended that you use the Metadata exchange configuration to proceed, although you may select Manual configuration, in which case proceed to the Advanced Settings section
image 9

Metadata Exchange

  1. Import the Rescale metadata into your identity provider (IdP) using the link provided.

If your IdP is self-hosted, your IT department will be able to assist you; if you are using a hosted service their configuration likely contains an input for this URL.

If you are required by the IdP configuration to enter fields manually, you can click Show Details here to view those data. If a field is required that you don’t see listed, contact Rescale support.

FieldValue
Entity IDhttps://platform.rescale.com/sso/metadata/
Assertion Consumer Servicehttps://platform.rescale.com/sso/login/callback/
Sign-On URLhttps://platform.rescale.com/login/
Single Logout Servicehttps://platform.rescale.com/sso/logout/
  1. Paste the URL to your IdP’s metadata in the Identity Provider’s Metadata input

The location of this XML depends on your IdP’s software configuration.

  1. Click Verify Settings to proceed.

If the URL you provided could not be loaded you may need to go back and correct it. If any of the fields are blank you must complete them, but the known fields are read-only and just for reference.

  1. Click Attributes to proceed to the next step. Attributes are data about the user released by your IdP that allows us to set up their profile on Rescale.
  2. (Recommended) Perform a test login in another tab by using the link provided. This will both confirm that the basic communication settings between your IdP and Rescale are correct, and show you which attributes were released to Rescale so that you can complete the rest of this step.

If the test login is successful, you will see a table of the attributes you can select from both in the tab you used to do the test login and in the form. If you don’t see an attribute that contains at least the e-mail address, your IdP will need to be configured to release one.

  1. Select or enter an attribute name for E-Mail Address. Provide Username only if the listed conditions apply to your organization, and select a Full name attribute if one is available.
  2. Click Policies and proceed to the Access Policy section below

Advanced Settings

Sign On Options

By defining Sign-On options, you have the added flexibility to allow the employees of your Organization to sign in with only single sign-on (SSO) or both single sign-on (SSO) and email. 

Access Policy

There are two types of access policies:

  1. Allow anyone from your organization
  2. Only allow invited users to sign on

The Allow anyone from your organization setting allows any employee with single sign-on to join your Rescale Organization. 

The Only allow invited users to sign on setting requires two conditions to be true:

  1. Employees must first be invited to Rescale by an Admin
  2. The Employee must have SSO configured if your Sign On Options are set to Sign on with Single Sign on only

Single Sign-On Logging

Once you’ve set up single sign-on, you can see recent sign-in successes and failures by navigating to Portal > Security, and then clicking on the Single Sign-On tab.

Once you’re there, you can view successful, failed, and incomplete logins.

LAk02assvYni9UJAB3w2UV6Rr3RBIKBE3G1vvDsykbBIcsnZs LWUQygEe7mTd80ci2jPV8nRVB0HV1lBJHa QZltWSqV rXJJntLtzpwoD6jg6cVqYw6VICn ZIvfVjH3tUa

Status Icons:

  • A green checkmark indicates that the login was successful
  • A red cross indicates that the login failed (expand for additional information)
  • A yellow line indicates that the logic was incomplete. In this case, someone initiated a login via SSO, redirected to the IdP, but then never redirected back to Rescale. This is not necessarily an issue, the user could have closed the tab after the IdP redirect.

In order to view detailed information of the success, failure, or incomplete login, simply click on the user to open a chronological log.

FAQ

Do you have documentation on how to set up SSO with my identity provider (IdP)?

Yes, we have documentation with select identity providers:

  • Logging into Rescale with a Microsoft Active Directory Identity Provider here
  • Microsoft Tutorial: Azure Active Directory integration with ScaleX Enterprise here
Can I use SSO in my region? 

If you are located in an international region and are using one of Rescale’s international platforms, make sure to use the correct platform domain and URL. This is crucial when configuring your Azure AD SSO. Note that the Microsoft doc uses a US platform in the instructions. 

After enabling SSO, will existing Rescale users still be able to log in?

Yes, existing users will continue to have access after SSO is enabled, provided they have an identical email address on Rescale and with their SSO IdP.

Can we merge accounts that are using the same email address? 

No, merging accounts is not currently possible.

If the e-mail address associated with the Rescale user account does not change, after enabling SSO, will account data continue to be available? 

The data and all attributes of the account will continue to be available after SSO is enabled for accounts where the email address has not changed. 

Does enabling SSO affect existing API tokens? 

No, existing API tokens are not impacted. They will continue to function as before.