Optional Add-On Connector that provides your organization with the ability to use a third-party identity provider (such as ADFS, Ping, or other SAML 2.0 compliant providers) for a single sign-on authentication into your Contract Insight application.
SINGLE SIGN-ON (SSO) AUTHENTICATION
ENHANCEMENTS
Single Sign-On Continues to Work Without Re-registering Your Identity Provider
Reference #: 260916.500.0001
Contract Insight accepts a signed sign-in response at whatever address your identity provider already posts to rather than insisting on one fixed address, and the older sign-in, sign-out and sign-on error addresses still resolve for an identity provider or a bookmark that names them, so no change is required at your identity provider in order to upgrade. A dedicated single sign-on address is also published and is the recommended target for any new registration. Service provider details for a new or refreshed registration, including the signing certificate and both the SAML and WS-Federation descriptions, are downloaded from the Single Sign-On screen under Administration and can be handed to your identity provider directly. Single sign-on remains separately licensed and stays off until that license is present.
Sign-in checks are stricter than they were in version 22.7. A response must carry exactly one signed assertion, that assertion must carry an expiration time and fall inside its own validity window with five minutes allowed for clock difference, and the same assertion cannot be presented twice. Identity is read only from the part of the document the verified signature actually covers. An identity provider that issues assertions without an expiration time will need adjusting, so confirm one live sign-in with your provider in a test window before your users rely on it.
How will this affect users?
Users sign in exactly as they did before and see no difference. Administrators and identity provider owners should schedule one live sign-in test before go live, but no re-registration is required as a matter of course.
Redesigned Single Sign-On Administration Screen
Reference #: 260916.500.0002
Single sign-on is configured on one screen under Administration. It carries the login method switch, the service provider metadata and certificate downloads, upload and removal of identity provider certificates from either a certificate file or a metadata file, and the configuration editor laid out as setting, description and value. Required fields and address formats are validated on save, and the single logout address is disabled when single logout is switched off. A Metadata for this configuration row action opens the metadata download links built from that configuration's own values, which matters when more than one identity is tested against the same provider; in the previous version an administrator had to create an empty configuration first just to obtain its metadata. A Refresh configuration action reloads the settings on a running site, so a change made on one instance, or written directly to the database, no longer leaves other instances enforcing the old values until they are restarted. An audience switch puts your own people and the Vendor/Client Gateway on this one screen instead of two near identical ones, each audience keeping its own identity provider settings and sign-in method; the Gateway audience additionally offers the Simplified login method, which only it has.
The login method switch is deliberately cautious. It refuses to turn single sign-on on unless there is at least one active unexpired identity provider certificate and exactly one active configuration carrying a sign-in address, so a half finished configuration can no longer lock everyone out. Where the connector is not licensed, the screen hides the sign-on sections and pins the method to standard sign in.
How will this affect users?
End users are not affected as only System Administrators have access to this setting.
Single Logout in Both Directions
Reference #: 260916.500.0004
Where single logout is configured, signing out of Contract Insight sends a signed logout request to the identity provider, and a sign-out started at the identity provider now ends that person's Contract Insight session as well. The service description Contract Insight publishes also now names the sign-out binding it genuinely uses, so an identity provider configured from that description will connect correctly, and an identity provider still pointing at the older sign-out address is forwarded automatically.
Two conditions decide whether single logout happens at all, and both are as they were in version 22.7. Single logout applies to SAML 2.0 configurations only; it is not offered for Integrated Windows Authentication or for the WS-Federation style sign in methods. And where a sign out redirect address is configured for your system, that address takes precedence and no single logout message is sent, so a site with one set will see nothing happen when single logout is switched on.
How will this affect users?
Users at organizations with single logout enabled are signed out of Contract Insight when they sign out at their identity provider, which is the behavior that was expected but not delivered before.
Just In Time Provisioning Has Its Own Screen
Reference #: 260916.500.0005
The rules that create and update employee accounts at sign in are edited on their own screen, opened with a row action next to Edit on the single sign-on configuration list. In the previous version an administrator had to choose a configuration from a separate list before anything on the provisioning page appeared; the configuration is already known from the click here. Each definition holds its conditions, its field map and the security groups to grant with their own nested conditions, edited as a tree on screen and applied with one Save per definition rather than a round trip for each row. The global provisioning switches sit on the same screen, and the case sensitivity option is now labeled for what it actually does at sign in, with the stored value and the behavior unchanged.
How will this affect users?
End users are not affected as only System Administrators have access to this setting.
Single Sign-On Debug Log Grouped by Sign-In Attempt
Reference #: 260916.500.0006
When debugging is switched on for a single sign-on configuration, every step of a sign-in attempt is traced, and a Debug log button on the Single Sign-On screen opens the recent attempts, newest first, each expandable into its own ordered steps. Each attempt is grouped as one conversation rather than reconstructed from the text of the messages. The trace includes the response exactly as the identity provider sent it and the transformed version, shown in a fixed width font, which is what an administrator needs in order to copy an attribute name across when wiring up a new provider. It also records what just in time provisioning did: the statements used to add or update the person, the security group statement, the complete batch that ran, and the reason a rule did not match, such as an attribute that was not sent or the expected value set against the value received. That distinguishes a mapping that never ran from one that ran and was overwritten afterwards.
How will this affect users?
End users are not affected as only System Administrators have access to this setting. Administrators can diagnose a failing federated sign-in without needing access to the server.