# How to Set Up SSO Using Centrify

Apica supports Single Sign-On (SSO) using SAML and [Centrify](https://www.centrify.com/).

Centrify provides an identity provider (IdP) service with its own users and roles management, integrating with ASM.

### How to Create a User in Centrify <a href="#howtosetupssousingcentrify-howtocreateauserincentrify" id="howtosetupssousingcentrify-howtocreateauserincentrify"></a>

| **Step**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | **Screenshot** |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
| To access the SSO settings, click the button in the top right corner of the User view.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                |
| Click the green “Single Sign-On (SAML 2.0) button Settings Dialog screen.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                |
| The SSO view contains all settings needed to connect a user account with a SAML provider account.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                |
| <h3 id="howtosetupssousingcentrify-configuration">Configuration</h3>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                |
| <h4 id="howtosetupssousingcentrify-enable">Enable</h4><p>The <strong>Enabled</strong> section contains a setting for enabling or disabling Single Sign-On for the account.</p><p>The <strong>Enabled</strong> setting applies to the current account only.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                |
| <h4 id="howtosetupssousingcentrify-identityprovider-samlmetadataurl">Identity Provider (SAML Metadata URL)</h4><p>The <strong>Identity Provider</strong> section contains settings for connection to the SAML provider.</p><p>If the SAML provider has a SAML metadata URL, you can use that. ASM will extract the needed login URL and certificate automatically.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                |
| <h4 id="howtosetupssousingcentrify-identityprovider-specifysettings">Identity Provider (Specify Settings)</h4><p>For other SAML providers, you may need to specify settings manually.</p><p><strong>Sign-in URL</strong> (The IdP Login URL, which you can find in the provider's settings.)</p><p><strong>Signing Certificate</strong> (Certificate for sign-in, which you can download from the provider app settings.)</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                |
| <h4 id="howtosetupssousingcentrify-serviceprovider">SERVICE PROVIDER</h4><p><em>Use this information about ASM as a Service Provider to set up your Identity Provider.</em></p><ul><li><p><strong>Service Provider Entity ID</strong></p><ul><li><p>Use this URL to identify ASM to your IdP uniquely and get the Service Provider’s (Apica’s) Metadata.</p><ul><li><a href="https://wpm.apicasystem.com/AuthServices"><https://wpm.apicasystem.com/AuthServices></a></li></ul></li></ul></li><li><p><strong>Assertation Consumer Service</strong> <strong>URL</strong></p><ul><li><p>Set your IdP to post SAML responses to this URL.</p><ul><li><a href="https://wpm.apicasystem.com/AuthServices/Acs"><https://wpm.apicasystem.com/AuthServices/Acs></a></li></ul></li></ul></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                |
| <h4 id="howtosetupssousingcentrify-samlattributestatementsmapping">SAML ATTRIBUTE STATEMENTS MAPPING</h4><p><em>ASM requires several attributes to be presented in SAML assertion. Note that attribute names may include namespaces.</em></p><ul><li><strong>User Name</strong> (A <strong>UNIQUE</strong> SAML attribute statement name for user name.)</li><li>F<strong>ull Name</strong> (SAML attribute statement name for user's full name.)</li><li><strong>Email</strong> (SAML attribute statement name for user's full name.)</li><li><strong>Identity Provider Roles</strong> (SAML attribute statement name for user's roles list provided by your IdP.)</li><li><strong>Set Default</strong> (Apply default settings for Centrify.)</li><li><strong>Reset</strong> (Clear the settings.)</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                               |                |
| <h4 id="howtosetupssousingcentrify-rolesmapping">ROLES MAPPING</h4><p><em>The Identity Provider User roles/groups must map to User Roles and Monitor Groups to access Apica Synthetic Monitoring.</em></p><p>Make sure that SAML roles you use already exist in Centrify.</p><p><strong>Identity Provider Roles Mapping</strong> (Associate roles used in the IdP with User Roles and Monitor Groups in ASM)</p><ul><li><strong>IdP Role / Group</strong> (Name of user role (or group) in the IdP.)</li><li><strong>User Roles</strong> (List of User Roles in ASM to associate with the IdP role.)</li><li><strong>Monitor Groups</strong> (List of Monitor Groups in ASM to associate with the IdP role.)</li><li><strong>Co-Owned Monitor Groups</strong> (List of Monitor Groups for the Customer Power User Role to associate as co-owner with the IdP role.)</li><li><strong>Comment</strong> (Additional information about the mapping.)</li></ul><p><strong>Overwrite Access Settings for Monitor Groups</strong> (Access settings for Monitor Groups will be overwritten every time the user logs in.)</p><ul><li>Check = Yes to Override with each login.</li><li>Uncheck (default) = Accept default Access permissions</li></ul> | <p></p><p></p> |
| <h4 id="howtosetupssousingcentrify-varioussettings">VARIOUS SETTINGS</h4><ul><li>Default Regional Setting (Choose a Standard Language/Region to apply to all users.) </li><li>Default Time Zone (Choose a Standard Timezone to apply to all users.)</li><li><p>Session Time (Duration of the web session in minutes.)</p><ul><li>Defaults to 720 minutes/12 hours</li></ul></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                |
| <h4 id="howtosetupssousingcentrify-cancel-test-save">Cancel/Test/Save</h4><p>To <strong>Cancel</strong> any <strong>Changes</strong> or <strong>Test</strong> to verify that your settings work, you can use the corresponding buttons.</p><ul><li>This page will display any resulting test problems with the configuration.</li><li>Don’t forget to <strong>Save</strong> your changes when satisfied</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                |

### Loggin into ASM using Centrify’s SSO <a href="#howtosetupssousingcentrify-logginintoasmusingcentrifyssso" id="howtosetupssousingcentrify-logginintoasmusingcentrifyssso"></a>

You can log in with a user existing in Centrify and be granted access to the application (it's described above). After successful login, you will be redirected back to ASM. If you were already logged in to Centrify, then you will be redirected automatically to ASM. If you want to use another test user, go to the Centrify user SSO page (<https://12345.my.centrify.com/my> and press log out).

| **Step**                                                                                                              | **Screenshot** |
| --------------------------------------------------------------------------------------------------------------------- | -------------- |
| With the setup used in the examples above, go to <http://alpha.foo.com>, log out.                                     |                |
| On the log in page, choose "Sign in using SSO"                                                                        |                |
| <p>Insert customer name SSOTestA, and press "Continue."</p><p>You will be redirected to the Centrify log-in page.</p> |                |

You can log in with a user existing in Centrify and granted access to the application, as described above.

After successful login, you will be redirected back to ASM.

If you were already logged in to Centrify, then you will be redirected automatically to ASM.

If you want to use another test user, go to the Centrify user SSO page and press log out.