SSO Configuration

Overview

The following requirements and steps and details should be followed and shared with First Orion to enable SSO. Currently, SAML is the only single-sign-on authentication mechanism available.

Requirements

1. IdP Initiated
2. SAML
3. metadata.xml

Pre-Requisites

Send request to [email protected] to initiate SSO configuration.

Steps

1. Configure the following URLs in your IDP

2. Declare an EntityId to be shared with First Orion and configured in metadata.xml
   Commonly, and EntityId is the customers URL - for example: https://firstorion.com/sso_entityId
3. Update metadata.xml file to include AudienceRestriction
   XML

   <saml:AudienceRestriction>
     	<saml:Audience>https://portal.firstorion.com/app/saml:Audience>
   </saml:AudienceRestriction>
   

   
   
4. Provide Updated metadata.xml file to First Orion
5. Configure users in IDP to access First Orion Application

FAQ

Q: Does the First Orion Service require any custom claim/custom attribute configurations?

A: No, custom claims or attributes are required. However, if you want to override default user role (Business Admin) you can optionally send a custom attribute:

• Custom attribute: "roleId"
• Custom attribute value: _Provided by First Orion (UUID format)

Q: What subject is expected in the authentication result?

A: Email