Single Sign-On

SSO setup involves the exchange of metadata between the Identity Provider and the Service Provider. This can be challenging because each side requires information from the other side before setup is complete. These instructions assume that the Access Unify | Lifecycle configuration is both the first and last step to minimize the impact on customer IT resources.

1. Log in to Access Unify | Lifecycle with administrator privileges.
2. Click on the Admin link and then click on the Identity Providers tab.
3. Create a New identity provider. Use “TBD” for the fields SSO URL, Entity ID, and IdP Certificate. See the Identity Provider Record Fields table below for additional details.
4. Download the metadata file by clicking on the Access Unify | Lifecycle SSO Metadata link.
5. Provide the metadata file to the administrator of the IdP. An Identity Provider (IdP) is the system that produces SAML assertions and authenticates users. The IdP is provided by the customer setup needs to be completed and necessary users (those who are named users in Access Unify | Lifecycle) need to be granted access in the configuration. Once completed, the IdP administrator will send the necessary metadata.
6. Once you have received the IdP metadata (certificates are sometimes provided separately for convenience), complete the setup of the identity provider record. Enter the correct values for SSO URL, Entity ID, and IdP Certificate. Verify the configuration of the remaining fields.
7. In Access Unify | Lifecycle SSO, test the SSO setup by opening a fresh web browser (or private/incognito browser window) to the Access Unify | Lifecycle SSO ACS URL.

To view an example of the Identity Providers tab, hover your mouse over the image.

The table below describes SSO and Access Unify | Lifecycle terminology.

The Access Unify | Lifecycle Employee Portal SSO setup follows the same process as Access Unify | Lifecycle SSO Configuration; however, there are some key differences:

1. Select a portal user for Employee Portal User Mapping to grant access to users without a named user in Access Unify | Lifecycle.
2. You generally will not want to show this option on the login page.
3. The IdP administrator will typically grant access to this connection for all users in the organization, not just Access Unify | Lifecycle named users.
4. For metadata and testing, be sure to use the Metadata link under the Employee Portal SSO heading.
5. To access the Employee Portal, use the ACS link along with the desired relay state. See the table below. Replace the Xs with connection specific IDs.

SSO URLs for the Access Unify | Lifecycle Employee Portal

The table below describes the fields available for identity provider records in Access Unify | Lifecycle.

Access Unify | Lifecycle does not support just-in-time user provisioning. You need to create user accounts for all named users who will access Access Unify | Lifecycle. You do NOT need to create a user account for anybody who will be using the Employee Portal anonymously.

Your configuration determines how match your Access Unify | Lifecycle user accounts with your IdP accounts. The default option is to match against the Access Unify | Lifecycle account username. Other options include Email address and Federation ID. The email address is typically the same as the username in Access Unify | Lifecycle, but it doesn’t have to be. Federation ID can be any string that is unique across the users in your account.

The table below describes the Login Policy options applicable to SSO.

To view an example of the Login Policy tab, hover your mouse over the image.

The SSO login page, using the Login URL specified above, will provide all identity providers set to be visible on the login page:

If your IdP is ADFS, make sure that your identity provider configuration in Access Unify | Lifecycle has set the Authentication Context field to Disabled. Other values may still result in a successful login, but you may be prompted to re-enter your credentials even if you have already authenticated against Active Directory.