Configuring an identity provider that supports SAML 2.0
SC//Nexus™ supports federating to your choice of identity provider that supports the SAML (Security Assertion Markup Language) 2.0 protocol. Some commonly used identity providers are Okta, JumpCloud, OneLogin, Google, Microsoft Entra, and Duo Single Sign-On.
This topic is the reference for the SC//Nexus side of the connection: the service provider details your identity provider needs and the settings SC//Nexus expects. It supports steps 1 and 2 of Onboarding your organization to SC//Nexus, which describes the whole setup process, including what you send to Scale Computing and what Scale Computing does with it. For the sign-in experience once setup is complete, see Signing in to SC//Nexus.
Service provider details
SC//Nexus publishes the service provider details your identity provider needs to set up the connection. The same values are available as a metadata URL, as a metadata XML document, and as individual parameters for manual entry. Use whichever form your identity provider accepts.
Using the SC//Nexus metadata URL
Some identity providers let you submit a URL that links to the service provider metadata. The URL returns an XML document containing the service provider metadata, so the identity provider can read and load the values without you filling in each field manually.
SC//Nexus provides the following metadata URL.
https://nexus.scalecomputing.com/api/v1/saml/metadataUsing the SC//Nexus metadata XML file
Some identity providers let you upload the service provider metadata XML file instead. Retrieve the XML from the same URL and save it as a file to upload.
https://nexus.scalecomputing.com/api/v1/saml/metadataManual setup
Some identity providers don't accept a URL or an XML upload. In these cases, configure the application manually with the following values. Which parameters you must supply varies with the identity provider.
| Parameter | Value |
|---|---|
| Service Provider (SP) Entity ID, SP Issuer, or Audience URI | https://saml.stargate.local |
| Assertion Consumer Service (ACS) URL, or Single sign-on URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| ACS binding | HTTP-POST |
| Assertion | Signed. SC//Nexus sets WantAssertionsSigned, so the identity provider must sign the assertion. |
| Authentication requests | Not signed. SC//Nexus does not sign its AuthnRequest, so do not configure the identity provider to require a signed request. |
| Signing certificate | Download from https://nexus.scalecomputing.com/sso/.well-known/saml.cer |
| Single Logout URL | Not supported. SC//Nexus publishes no SingleLogoutService endpoint, so leave any single logout field blank. |
The SC//Nexus entity ID is https://saml.stargate.local, which is an internal identifier rather than a public URL. This is the value SC//Nexus publishes in its metadata, so enter it exactly as shown. It is an identifier only and is never resolved as a hostname.
Parameters that SC//Nexus does not declare
The SC//Nexus service provider metadata does not declare a NameIDFormat, a signature algorithm, or a digest algorithm, and it requires only that the assertion be signed rather than the whole response. Identity providers that insist on a value for these settings should be configured to send the user's email address as the NameID, matching the account email in SC//Nexus, with RSA-SHA256 signatures and SHA256 digests.
Identity provider examples
We provide the following documentation for a few of the identity providers we support. If you use another identity provider and need assistance, contact Scale Computing Support.