Using SAML 2.0 for Single Sign-On (SSO) Authentication

OneTrust utilizes Security Assertion Markup Language (SAML) 2.0 for Single Sign-On (SSO) authentication. SAML 2.0 is a cross-domain, XML-based protocol which enables user-level authentication using a single ID across web applications. SAML leverages an Identity Provider (IdP) server to manage user identities, attributes, and entitlements to grant access to enterprise applications and information with a single user ID and password. The user's position in the organization can be used to determine their level of access to enterprise applications and information. 

OneTrust supports two request and response binding types: POST and REDIRECT. This provides administrators with the flexibility necessary to integrate with most IdPs.

SAML authentication can also be used to provision users "on the fly" using Just-In-Time (JIT) provisioning. The responses can be configured to gather the minimum elements required to create a user, assign a role, and associate them to an organization. When SAML authentication is enabled in OneTrust, the user is redirected to the IdP for authentication. 

Note:

OneTrust integrates with different IdP applications by adhering to the defined SAML 2.0 protocols. OneTrust has been tested with and can provide implementation information for several popular IdPs.

High-Level Overview

In order to use SAML for SSO authentication, you need to set up a trust between the Service Provider (SP) and the IdP. Currently, this is supported using SAML Authentication without AD, LDAP, or Lotus Domino for user synchronization. This method uses attribute mapping from the SAML response to provide the SP, OneTrust, with information about the end-user. The steps are as follows:

  1. Send the SP (OneTrust) metadata to the IdP. 

    Reference the OneTrust Environment Metadata section in the Managing Single Sign-On (SSO) article.

  2. Import the SP metadata into the IdP and register the SP as a trusted entity.

    This step will be done by your organization's IT representative.

  3. Provide the IdP metadata - Login and Logout URLs for the IdP and associated certificates, if applicable.

    Your organization's IT representative should provide this information to OneTrust.

  4. Configure the SP to authenticate with the IdP by acquiring and configuring the IdP's metadata in OneTrust.

    This should be completed by your Site Admin.

  5. Verify the certificates used by the IdP.

    This will be completed by OneTrust.

  6. Test and save the SP SAML configuration.

    This will be completed by OneTrust.

Types of SSO Authentication

OneTrust supports both SP-Initiated and IdP-Initiated SSO authentication. The following diagrams illustrate examples for both SSO authentication flows.

SP-Initiated SSO



An SP-Initiated SSO authentication flow works in the following way:

  1. User attempts to log in to OneTrust.

  2. OneTrust redirects to the IdP for user authentication.

  3. The IdP authenticates the user and responds using POST to provide the user details and establish a return communication.

  4. (Optional) OneTrust can use a certificate passed by the IdP as a "trusted certificate."

IdP-Initiated SSO



An IdP-Initiated SSO authentication flow works in the following way:

  1. User attempts to log in to the IdP and accesses OneTrust from the list of available application.

  2. The IdP authenticates the user and responds using POST to provide the user details and establish a return communication.