Single sign-on with SAML

Requirements

• Admin privileges in Sigma; see Account types.
• An identity provider (IdP).

Understanding SSO and SAML

What is SAML?

SAML, Security Assertion Markup Language, is a widely used security protocol. It provides secure authentication and authorization between a service provider (SP) and an identity provider (IdP).

A service provider is the web application that you would like to gain access to. In this case, it’s Sigma.

An identity provider is a software service that performs authentication related services (OAuth, account status verification, account attribute declaration). Examples of IdPs include Okta, OneLogin, and Google SSO.

Service Provider (SP) and Identity Provider (IdP) Authentication

By default, Sigma supports SP-only authentication via the the Sigma login page. In order to additionally use IdP-initiated authentication from the IdP's console you must provide your IdP with a RelayState / StartURL.

Configure SSO for your Sigma Organization

Follow the steps below to connect SSO for your Sigma organization. This is a multi-stage process that involves SAML configuration in both the IdP and Sigma.

[Step 1] Configure your Identity Provider

Confirm your Sigma Cloud Service Provider

Sigma organizations can be hosted on AWS, Azure, and GCP. Your IdP configuration will differ based on what cloud provider yours is hosted on. Before you get started, please confirm your organization's cloud provider in your Administration Portal's Account page, under the Site heading. See Technical Specifications for more information. 

Note: All GCP configurations must be custom. Do not use the Google app to configure.

Select and Configure your IdP

If your company uses Okta, you have an option to use a  pre-configured application to set up SSO access to Sigma. Please visit your IdP to understand how to use this application. Instructions can be found by searching for "Sigma Computing" in your IdP’s marketplace.

If your company uses a different IdP, follow that IdP's instructions for setting up a SAML application and verify that the following fields are set. You can enter those fields manually, or import them using the Sigma metadata file:

https://{{prefix}}.sigmacomputing.com/api/v2/saml2/2/metadata.xml

The {{prefix}} must be replaced with the cloud prefix specific to your cloud, listed in the table below.

[Step 2] Configure SAML in Sigma

1. Open your Admin Portal by selecting Administration in the user menu at the top right of your screen.

   

2. Select the Authentication page from the left hand panel.

3. Click the Edit button under Authentication Method and Options.

4. Select SAML from the Authentication Method dropdown menu.

   

5. Enter your Identity Provider login / Single Sign On URL, also referred to as a SAML 2.0 Endpoint (HTTP).
   This information is found in your IdP portal.

6. Enter your the X.509 Certificate for your IdP. You can get this from your IdP.

7. In the Export Authentication field, click Edit to allow exports to approved domains.

8. Click Save.

Update your SAML certificate

Before your SAML certificate expires, you need to update it in the Administration portal to avoid losing access to your Sigma organization.

1. Open the Administration portal by selecting Administration in the user menu at the top right of your screen.
2. Select the Authentication page from the left hand panel.
3. Click Edit under Authentication Method and Options.
4. In the Identity Provider X.509 Certificate field, enter the new certificate from your IdP.
5. Click Save.

If your SAML certificate already expired and you are unable to log into your Sigma organization, contact Sigma Support. See Submit a support request.

Behavior of "userRole" and "userGroups" attributes

🚧

If you make account type or team membership assignments in your IdP, do not change these assignments in Sigma. Configurations set in your IdP take precedence over any configurations in Sigma. For example, if you change a user's role in Sigma, this role will not be written back to your IdP. The next time you log into Sigma, the user’s role will be reset to their IdP declared role.

The expected behavior of the "userRole" and "userGroups" attributes depends on how they are configured in your IdP: