Using a SAML 2.0 identity provider

SC//Reliant™ Platform Manager console is accessible over the internet. It supports authenticating using your choice of identity providers that support the SAML (Security Assertion Markup Language) 2.0 protocol. Some commonly used identity providers are Okta, JumpCloud, OneLogin, Google, Microsoft Entra, and Duo Single Sign-On.

SC//Reliant Platform Manager provides metadata that your identity provider uses to set up the connection between your identity provider and SC//Reliant Platform Manager. There are a few common ways that this connection is set up, depending on the requirements from your identity provider.

Federation strategy

Federating the SC//Reliant Platform Manager to a customer-managed identity provider keeps authentication, multi-factor enforcement, and conditional-access policy in a single place, the customer's IdP, rather than duplicating identity policy inside the platform. This is the recommended access model for any deployment that already operates a corporate IdP.

The SAML 2.0 integration supports the following identity providers:

• Okta
• JumpCloud
• OneLogin
• Google
• Microsoft Entra
• Duo Single Sign-On

With federation in place, the SAML layer carries authentication and conditional access (including device posture, geo-restriction, and risk-based step-up prompts enforced by the IdP), while the SC//Reliant Platform Manager continues to own authorization through its role-based access control model. The two layers are independent: SAML asserts who the user is and that they have satisfied the IdP's authentication and conditional-access policies; the platform then evaluates the user's assigned role to determine what they can do.

When a user signs in, they enter their email address on the SC//Reliant Platform Manager sign-in page and are redirected to the identity provider configured for their Authorization Site. After the identity provider authenticates them, SC//Reliant Platform Manager matches the user by email address, so the NameID that the identity provider returns must equal the email address on the user's SC//Reliant Platform Manager account. If no account has that email address, sign-in fails with the message "The specified email address isn't associated with an Acumera Reliant account." A user who signs in successfully has access to all of their Assigned Sites. For more information, see Sites and access.

When the IdP supports System for Cross-domain Identity Management (SCIM), federation also enables just-in-time and lifecycle provisioning so that account creation, role updates, and de-provisioning in the platform follow the upstream directory rather than being maintained manually. This keeps joiner / mover / leaver state in the platform aligned with the identity system of record.

For accounts that are not federated, Cisco Duo MFA is enforced for the SC//Reliant Platform Manager. Federation does not remove the requirement for MFA; it moves MFA enforcement into the IdP. Note that this built-in Duo MFA fallback is distinct from federating to Duo Single Sign-On as a SAML identity provider: the former is the default multi-factor challenge applied to non-federated accounts, while the latter is a full federation option covered in its own guide below.

Using the SC//Reliant Platform Manager metadata URL

Some Identity Providers (IdPs) allow users to submit a URL that links to their Service Provider (SP) metadata. This URL must return an XML document containing the SP metadata, enabling the IdP to automatically read and load the information without requiring the user to fill in each field manually.

The SC//Reliant Platform Manager provides the following metadata URL to use.

https://platform.reliant.io/saml/metadata

Using the SC//Reliant Platform Manager metadata XML file

Some Identity Providers (IdPs) allow users to upload the Service Provider (SP) metadata XML file. Similar to using a metadata URL, uploading the SP metadata XML file enables the Identity Provider (IdP) to automatically read and load the information, eliminating the need to manually fill in each field.

To download the metadata XML file from SC//Reliant Platform Manager, you should authenticate and then navigate to the following URL.

https://platform.reliant.io/saml/metadata.xml

Manual setup

Some identity providers don't provide a way to submit a URL or upload an XML file. In these cases, you can set up the application manually using the following details. The parameters you must specify will vary depending on the requirements of the identity provider you use.

Identity Provider examples

We provide the following documentation for a few of the Identity Providers we support. If you have another preferred Identity Provider and need assistance, reach out to SC//Reliant Support.

• Using Duo Single Sign-On as an identity provider
• Using Okta as an identity provider
• Using Microsoft Entra as an identity provider
• Using Google as an identity provider
• Using JumpCloud as an identity provider
• Using OneLogin as an identity provider
• Using PingFederate as an identity provider

Related documentation

• Access and authentication
• Managing users
• Using Duo Single Sign-On as an identity provider
• Using Okta as an identity provider
• Using Microsoft Entra as an identity provider