Managing an SSO Authentication Group
SSO authentication group
The SSO authentication process is characterized by claims. These claims include the groups or roles the user belongs to. These groups have a unique identifier that can be entered in the Authentication identifier attribute.
Example: the claim role "rCmp-WebAXDevRemoteRdpTier2@MEGA”
Defining an SSO authentication group
To define an authentication group:
1. Access the authentication group management pages.
2. In the edit area, in the Authentication groups tab, click New 
.
.The authentication group creation window appears.
3. In the Name field, enter a name for the authentication group.
4. In the Authentication Identifier field, enter the identifier of the claim with which you want to map the authentication group.
Example: the claim role "rCmp-WebAXDevRemoteRdpTier2@MEGA”
5. Click OK.
6. Associate a Hopex person group with the authentication group: in the Authentication Group list, click in the Person Groups field then select the person group.
Configuring SSO Authentication
The SSO service includes information (claims), which enables to identify a user or a user group.
Claims
The claims are included in the SSO service.
Examples of claims: a name, a group, an email, a role.
These claims are used to map this information with the data included in Hopex.
To identify a person, you can for example map:
• the "displayname" claim with the Name attribute of the person in Hopex.
• the "email" claim with the E-mail attribute of the person in Hopex.
To identify a person group, your SSO service must include groups. These groups are listed under the claim "role".
To modify the claim used for mapping authentication groups, modify the ClaimForRoles of the identity provider (see Installation and Deployment > Hopex Unified Authentication Service documentation).To identify a person group, you can for example map:
• The claim role "rCmp-WebAXDevRemoteRdpTier2@MEGA" with a person group in Hopex.
Example of information included in an SSO service:
{
"ValidateLifetime": true,
"AccessTokenType": "Reference",
"TokenHandle": "52c900bcfe54f2ef081b3fa704e19e11",
"Claims":{
"aud": "https://hopex/UAS/resources",
"iss": "https://hopex/UAS",
.....
"displayname": "Lou,Watts",
"name": "lws",
"email": "lwatts@mega.com",
"given_name": "",
"family_name": "Watts",
"groupsid": [
"S-1-5-21-0123456789-0123456789-513",
"S-1-1-0",
"S-1-5-32-544",
"S-1-5-32-545",
],
"role":[
"Domain Users@MEGA",
"Everyone",
"Administrators@BUILTIN",
"Users@BUILTIN",
"NETWORK@NT AUTHORITY",
"Authenticated Users@NT AUTHORITY",
"This Organization@NT AUTHORITY",
"rCmp-WebAXDevRemoteRdpTier2@MEGA",
"tNtfs-USTLVUCSD651DImagesRecorderModify@MEGA",
"tSvc-WebAX8AppXtenderRetentionFilingServiceFull@MEGA"
],
"lws": "1ae8ad551970e66e071536655b9542ad"
}
}
Configuring SSO Authentication
To configure SSO authentication:
1. Define the authentication parameters.
For example: the name and e-mail of the person.
2. If you manage person groups:
• Define the authentication groups.
• Map the authentication groups with the person groups defined in Hopex.