COBBLESTONE SOFTWARE

Contract Insight — User Guide

Identity Providers

Single Sign-On › Single Sign On Overview › Identity Providers

Note:  Each procedure in this guide begins at the Contract Insight homepage, so any section can be followed on its own. Custom fields are configurable, so the exact field list on a contract category record may vary between environments.

1. Overview

CobbleStone® supports the SAML 2.0 and ADFS / WS-Federation protocols for Single Sign-On (SSO). Each identity provider (IdP) has its own setup instructions for SAML authentication (see Section 7 for links). On the Contract Insight side, IdP setup happens on Administration → Single Sign-On. There you publish the Service Provider Metadata to your IdP, upload the IdP's signing certificate under Identity Provider Certificates, enter the IdP details in an SSO Configuration, and then switch the Login Method. Internal users (Your people tab) and vendors/clients signing in through the Vendor/Client Gateway (Vendors & clients (Gateway) tab) are configured separately, each with its own identity provider, certificate and login method.

2. Key Elements

• Your people / Vendors & clients (Gateway) tabs: separate SSO setups for internal users and Gateway users. Changing one never affects the other.
• Login Method: for internal users, Standard (username / password), Integrated Windows Authentication, SAML 2.0 Single Sign-On, or ADFS / WS-Federation. Click Apply to switch, and Refresh configuration to reload settings from the database.
• Service Provider Metadata: SAML metadata (XML), WS-Fed metadata (XML) and SP signing certificate (.cer). Give these to your IdP so it trusts Contract Insight as a service provider.
• Identity Provider Certificates: upload the IdP's signing certificate with Add certificate, either as a file or from a metadata URL.
• SSO Configurations: the IdP connection settings (IDP Login URL, Audience Restriction, Entity ID, User Name Location, Assertion Consumer Service URL, Single Logout, Debugging), with row actions for Edit, Just-in-time provisioning, Metadata and Delete.
• Debug log: traces sign-in attempts when Debugging is turned on in a configuration.

3. Navigating to Single Sign-On

1. From the Contract Insight homepage, click the Administration icon at the bottom of the left navigation menu.
2. Under Security & Access, click Single Sign-On.

4. Connecting an Identity Provider (Your People)

4a. Sharing the Service Provider Metadata

1. On the Single Sign-On page, make sure the Your people tab is selected.
2. Under Service Provider Metadata (Give These to Your IdP), download the SAML metadata (XML) (or WS-Fed metadata (XML) for ADFS) and the SP signing certificate (.cer).
3. Use these files to register Contract Insight as an application/relying party in your identity provider, following the IdP's own instructions (see Section 7).

Note: Leave the Login Method on Standard until the certificate and configuration are complete and tested. Switching it first can lock users out.

4b. Uploading the IdP Certificate

1. Under Identity Provider Certificates, click Add certificate.
2. In the Add Certificate window, either:
   • Option 1: click Choose File and upload the .cer file or XML metadata file (containing the X509 certificate) exported from your IdP, or
   • Option 2: paste the IdP's federation metadata URL and click Download.
3. Confirm that the certificate is listed with its Expires date and shows as Active.

5. Configuring the SSO Configuration

1. Scroll to SSO Configurations. Click Add configuration to create one, or Edit on an existing row. The row icons also open Just-in-time provisioning, download this configuration's Metadata, or Delete it.

2. In Edit Configuration, complete the IdP details:
   • Name and Active: identify the configuration and turn it on.
   • Single Sign On Mode: Single Sign On Only, or Single Sign On and Standard Logins.
   • Standard Login Address: use Copy and keep this address somewhere administrators can find it. With Single Sign On Only, this address is closed and everyone is sent to the IdP.
   • IDP Login URL: the IdP URL users are redirected to when authentication is required.
   • Audience Restriction and Entity ID: usually the address the IdP redirects to. If Entity ID is blank, the ACS URL is used.

3. Continue with the remaining settings:
   • User Name Location: NameId, or Attribute with the exact (case-sensitive) attribute name from the assertion.
   • SP Initiate Method: Post or Redirect.
   • Assertion Consumer Service URL: the URL the IdP sends authentications to.
   • Enable Single Logout and Single Logout URL: optional; also signs the user out at the IdP.
   • Debugging: turn on while testing, then review attempts with Debug log.
4. Click Save (or Cancel to discard changes).

5. Back at the top of the page, set Login Method to SAML 2.0 Single Sign-On (or ADFS / WS-Federation) and click Apply. If the application runs on more than one server, click Refresh configuration on each instance.

6. Configuring SSO for Vendors & Clients (Gateway)

1. Click the Vendors & clients (Gateway) tab.
2. Repeat Sections 4 and 5 using the Gateway's own metadata, certificate and configuration. This setup is separate from your own people's.
3. Choose the Gateway Login Method: Standard (user name, password and company ID), Simplified (email address and password), SAML 2.0 Single Sign-On, or ADFS / WS-Federation. Then click Apply.

7. Identity Provider Documentation

Below are links to the documentation from popular/common Identity Providers:

Microsoft Azure AD:

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance 

Okta:

https://developer.okta.com/docs/concepts/saml/

One Login:

https://www.onelogin.com/learn/saml

Shibboleth:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview

Ping:

https://docs.pingidentity.com/

8. Quick Reference Summary