Onboarding your organization to SC//Nexus

This topic is for the administrator who sets up SC//Nexus™ access for your organization. It gives an overview of the setup from start to finish: what you configure in your own identity provider, what you send to Scale Computing, and what Scale Computing does with it. Each step links to the detailed procedure.

Setup is done once for each organization. After setup, your members sign in through your identity provider as described in Signing in to SC//Nexus.

How the work is divided

SC//Nexus federates with your identity provider using SAML 2.0. Setting up federation means configuring both sides of the connection, and the work is split between you and Scale Computing.

Your identity provider handles authentication, including credentials, multi-factor authentication, and any conditional access policies you enforce. SC//Nexus decides which Scale Computing products each member can open, based on what your organization is entitled to.

Before you start

You need the following:

• Administrator access to your identity provider. You need permission to create a SAML application and assign users to it.
• The email addresses of the people who need access. Each member's SC//Nexus account is identified by email address. That address must match the email address your identity provider sends for the user when they sign in. It must also match the email address on the user's account in each Scale Computing product, such as SC//AcuVigil™ or SC//Reliant™ Platform Manager. Capitalization differences are the most common cause of a mismatch.

Step 1: Get the SC//Nexus service provider details

Your identity provider needs the SC//Nexus service provider details to set up the connection. SC//Nexus publishes them in three forms: a metadata URL, a metadata XML file, and individual values for manual entry. Use whichever form your identity provider accepts.

The SC//Nexus metadata URL is https://nexus.scalecomputing.com/api/v1/saml/metadata.

For the individual values and how to use each form, see Configuring an identity provider that supports SAML 2.0.

Step 2: Create a SAML application in your identity provider

Create a SAML 2.0 application for SC//Nexus in your identity provider, using the service provider details from Step 1. Whichever identity provider you use, the application must meet the following requirements:

• The Assertion Consumer Service (ACS) URL is set to https://nexus.scalecomputing.com/sso/api/oauth/saml.
• The identity provider signs the assertion. SC//Nexus requires a signed assertion.
• The NameID is the user's email address. It must match the email address on the user's SC//Nexus account.
• The identity provider doesn't require signed authentication requests. SC//Nexus doesn't sign its requests.
• Single logout is left blank. SC//Nexus doesn't support single logout.

For the procedure for your identity provider, see one of the following topics:

• Configuring Okta as an identity provider
• Configuring JumpCloud as an identity provider
• Configuring OneLogin as an identity provider
• Configuring Google as an identity provider
• Configuring Microsoft Entra as an identity provider
• Configuring Duo Single Sign-On as an identity provider

If you use another identity provider, follow its documentation for adding a custom SAML 2.0 application, and contact Scale Computing Support if you need assistance.

Step 3: Assign users to the application

In your identity provider, assign the SAML application to the users or groups who need access to SC//Nexus. Users who aren't assigned to the application can't sign in to SC//Nexus, even if they have an SC//Nexus account.

Step 4: Send your identity provider details to Scale Computing

Once the application is set up, your identity provider generates its own SAML metadata. Send Scale Computing the following:

Send these to your Scale Computing account manager or Support. The metadata contains no secrets, but send it through a channel you trust so it can't be altered on the way.

Step 5: Scale Computing configures your organization

Scale Computing uses the details you sent to complete the SC//Nexus side of the setup:

1. Creates your organization in SC//Nexus.
2. Maps your organization to the Scale Computing products you're entitled to, such as SC//AcuVigil or SC//Reliant Platform Manager.
3. Attaches your identity provider to your organization.
4. Creates SC//Nexus accounts for your members.

Scale Computing tells you when your organization is ready.

Step 6: Test sign-in

Before you announce SC//Nexus to your members, sign in yourself to confirm the setup:

1. Go to https://nexus.scalecomputing.com/ and enter your email address. SC//Nexus confirms the address with Signing in as followed by your email address. If the address is wrong, choose Use a different email.
2. Choose Sign in with <identity_provider>, where <identity_provider> is the identity provider name you sent in Step 4, and complete authentication at your identity provider.
3. Confirm that the Your applications page opens and lists the products your organization is entitled to.
4. Choose Access now for each product and confirm that it opens.

If sign-in fails, check the following:

For more about the member sign-in experience, see Signing in to SC//Nexus.

Related topics

• SC//Nexus overview
• Signing in to SC//Nexus
• Configuring an identity provider that supports SAML 2.0