Single sign-on (SSO)

Single sign-on (SSO) is an authentication method that enables users to securely log in to multiple applications and websites using just one set of credentials.

Setting up SSO

Note!

For SSO to work, the connection has to be set up between Scoro and Identity Provider (IdP) using a custom SAML connector.
User matching and the login between Scoro and IdP are done via email (NameID value has to be set to email).

General overview of setup

The setup is generally divided into 4 steps:

Obtaining SSO credentials from Scoro for the IdP setup.
Creating and configuring a custom SAML connector on the IdP side and adding the IdP credentials to Scoro.
1. Creating and configuring a custom SAML connector in IdP using Scoro credentials (IdP specific).
2. Obtaining SSO credentials from IdP and adding them to Scoro for setup.
Configuring and verifying SSO in Scoro.
Enabling SSO in Scoro.

All the steps (except for step 2) are general and will apply to all IdP providers and setups. All steps are explained more thoroughly in the next paragraph and the second step can vary in different IdP providers. The necessary actions for most common IdP providers are listed below.

Setup

1. Obtaining SSO credentials from Scoro for the IdP setup
Open the single sign-on settings in Scoro (go to Settings > Administration > Single sign-on (SSO)).

2. Creating a custom SAML connector on the IdP side and configuring SSO credentials on both sides
Log in to your Identity Provider (IdP) account as an administrator in another tab or browser.
The creation and configuration steps are different for the IdP side and are explained separately for the most common IdPs below.

OneLogin

1. Go to Administration > Applications > Add App and search for “SAML Custom Connector (Advanced)“.
2. Once saved as a company app, you can start configuring the SAML connection.

3. Go to the SSO tab, where you can see the OneLogin's specific SSO fields.

1. Copy the Issuer URL into Scoro's Identity Provider Issuer field.

2. Copy SAML 2.0 Endpoint into Scoro's Identity Provider SSO URL field.

3. Copy the X.509 certificate into Scoro's Certificate field.

4. Once you've done this, Scoro's specific configuration will be available. Navigate to the Configuration tab in OneLogin and fill out the next fields.

1. Copy Scoro's Audience URI (Entity ID) value into the Audience (EntityID) field.

2. Leave the Recipient field empty.

3. Copy Scoro's Assertion Consumer Service (ACS) URL into OneLogin's Recipient and ACS (Consumer) URL fields.

4. If you need Single Logout, copy Scoro's Service Provider SLO URL into the Single Logout URL field in OneLogin.

Save your OneLogin's configuration.

Okta

1. Navigate to Applications and choose “Create App Integration“.
2. Choose “SAML 2.0” and click Next.
3. Add a name and a logo to the app, if needed.

4. Configure Okta’s SAML settings:

1. Add Assertion Consumer Service (ACS) URL from the Scoro SSO settings page to the Single Sign-On URL in Okta.

2. Add Audience URI (Entity ID) from the Scoro SSO settings page to Audience URI in Okta.

3. Leave RelayState empty.

4. Make sure to set the NameID format to EmailAddress and click Next, followed by Finish.

5. Now you have access to Okta's SAML values. Click View Setup Instruction in the Sign-On tab, which will open a separate page with SAML values.

6. Configure Scoro’s SSO settings:

1. Copy Okta's Identity Provider Single Sign-On URL into Scoro's SSO URL field.

2. Copy Okta's Identity Provider Issuer into Scoro's Identity Provider Issuer field.

3. Copy X.509 certificate into Scoro's Public Certificate field.

7. If you want to provide additional attribute mapping in Okta or just change the existing configuration.

1. Go to the General tab and click Edit on the SAML Settings section.

2. With Show Advanced Settings you have the choice of configuring Single Logout.

1. Okta supports only signed Single Logout and SP initiated logout (that is, when you log out of your Scoro account, you will also be logged out of Okta). Unfortunately, Scoro doesn’t support it yet.

Azure

1. Create a new SAML Application in Azure AD

1. In the Azure Portal, select Enterprise Applications and click New application.

2. Click Create your own application.

3. Add a Name for the applications, choose “Integrate any other application you don't find in the gallery (Non-gallery)” and click Create.

4. Go to Manage menu and click Single sign-on.

5. Click SAML and then click the pencil icon to edit the basic SAML configuration.

6. Using the information provided on the Service Provider tab in Scoro, complete the following fields:

- In the Identifier (Entity ID) field paste the Audience URL from Scoro.

- In the Reply URL (Assertion Consumer Service URL) field paste the Consumer URL from Scoro.

- In the Sign on URL field paste the SP SSO URL from Scoro.

- In the Logout Url field paste the Single Logout Url.

2. Set up Scoro SAML IdP settings

1. In the SAML Signing Certificate section in Azure AD, click Download to download the Certificate (Base64) and save it on your computer.

2. In your Scoro account, paste the contents of the file to the Public Certificate field under the SSO tab in Scoro.

3. Set up the Scoro SSO Identity Provider tab:

1. In Scoro's SSO URL field paste the Login URL.

2. In Scoro's Entity ID field paste the Azure AD Identifier.

3. (Optional) In Scoro's Identity Provider Single Logout Url paste the Logout URL.

3. Verifying SSO configuration in Scoro
Once the IdP side is configured and IdP credentials are added to Scoro, click the Connect button at the bottom of the SSO settings page to verify the SAML integration.

The verification process itself can go by three different scenarios:

1. The browser is already logged into IdP and the system will just refresh the page and the user receives a message.

2. The user is directed to IdP to perform a login after which the user will be directed back to Scoro and they receive a message.

Note! The verification login will have to be performed in the 5-minute window or the user has to retry the verification.

3. User receives an error message.

If there were any errors, the user will receive an error message and cannot enable SSO before all errors are cleared.

If all the fields were added correctly, the system will notify the user that the credentials were verified and SSO can be enabled.

4. Enabling SSO in Scoro
SSO can only be enabled if it is successfully verified.
While enabling the SSO, a message will be shown that security settings have been updated and all the users will be logged out of Scoro in 5 minutes.

All active sessions will be closed and all users will be logged out of Scoro in 5 minutes.

After enabling SSO, an extra setting will appear with the possibility to only allow administrators (by default), or both administrators and regular users to continue using their username and password to log into Scoro (In addition to SSO).

Updating the certification

7 days before the actual expiration of the current SSO certification, an email is sent to all administrators. This means that a new certificate will have to be generated on the IdP side and updated in Scoro.

To update the certificate in Scoro, take these steps:
1. Disable SSO.
2. Disconnect the connection with the SSO service provider.
3. Add the new certificate to Scoro.
4. Verify the new certificate.
5. Enable SSO.

Was this article helpful?

Yes
No