Set up SSO login to the Redox dashboard

We offer single sign-on (SSO) to the Redox dashboard using your own third-party identity provider (IdP). Redox serves as the service provider (SP) in your SSO flow.

SSO helps you control user access policies with a central resource for your organization.

Here are SSO glossary terms for your reference:

• Your IdP must support a SAML protocol.
• Choose whether to use an SP-initiated login (i.e., login initiated from the Redox dashboard) or IdP-initiated login (i.e., login initiated from your IdP). Redox supports both, however, IdP-initiated must be enabled for your Redox organization by your Technical Account Manager. SP-initiated is available today by default.
• You must be assigned to an organization owner role in Redox to configure or edit SSO. Learn about user roles.
• SSO is an advanced feature and must be enabled in your Redox organization. Talk to your Technical Account Manager if it’s not enabled.
• SSO is only for single Redox organization users. If your organization has users that are part of multiple Redox organizations, they must remove themselves or transfer access to a different Redox account before using SSO.
• (Recommended) Test the SSO configuration with your IdP before enabling SSO in the Redox dashboard. For example, check if users can log in to the IdP as expected. This confirms that your system works with the IdP before adding Redox into the mix.

  Test before enabling SSO

  If you don’t test before enabling SSO, you risk getting locked out of your Redox organization.

If you’re an organization owner, follow these steps to enable SSO.

1. Log in to the Redox dashboard.
2. In the bottom-left navigation menu, click your username to open the user menu.
3. From the user menu, select the Organization profile option.
4. By default, the Organization info page displays. Click the Settings tab.
5. Under the Single sign-on section, click the Configure button.
6. The SSO form opens. Under Redox authorization server values, we provide the Connection name value and Audience restriction value. Use these values in your IdP configuration.
7. Next, the Identity provider configuration contains details about your IdP. Specific configuration details vary between IdPs, but the basic process is the same. Fill in the relevant fields:
   • Name: Enter a human-readable name to represent your IdP (e.g., Okta).
   • Domain name: This field automatically populates with the company domain and isn’t editable. The domain is where your organization’s users have an email account.
   • Configuration mode: Select either the URL Import or Manual option.
     • URL import: Enter the public URL for your SAML metadata XML document. Redox pulls the entity ID and keys to validate the response from the IdP.
     • Manual: Provide the entity ID and keys yourself.
       • Signing certificate: Enter the public key that your IdP uses to sign requests. This should be an X.509 certificate encoded in PEM or CER format. Review the instructions for locating and downloading the certificate for your relevant IdP in the Step 2 section.
       • Sign-in URL: Enter the redirect URL for your users to log in to the IdP.

         Redox Sign-in URL vs. IdP Sign-in URL

         You must enter a Sign-in URL in both the Redox dashboard and your IdP, but these URLs shouldn’t be the same.

         • The Sign-in URL in the Redox dashboard should point to your IdP.
         • The Sign-in URL in the IdP should point to the Redox dashboard.

8. Under the Mapping section, the Identity attributes populate automatically, but you should confirm them or adjust as needed.
   • User full name: The name of the SAML attribute that your IdP uses for a user’s full name.
   • User email: The name of the SAML attribute that your IdP uses for a user’s email address.
9. (Optional) Under the Mapping section, fill out the Identity provider groups to map your IdP groups to Redox groups. This doesn’t add the IdP member to the Redox group; instead, it grants your IdP members the roles assigned to the Redox group upon sign-in.

   Configuring your IdP groups

   Refer to your IdP docs for configuring groups and getting group attributes or values:

   • Okta groups
   • Microsoft Entra ID groups

   1. Enter the groups attribute, which is the attribute your IdP uses to send group names (e.g., typically groups or memberOf). Leave this empty if you don’t map any groups.
   2. Click the Add mapping button.
   3. In the new field, enter the name of the identity provider group (matching is exact and case sensitive). Then select the Redox group to map to from the drop-down field.
   4. Click the Add mapping button again to map additional IdP groups (up to 100).

      Mapping to two Redox groups

      You can map the same IdP group to two Redox groups. Doing so grants the roles of both groups.

10. (Optional) Under Organization settings, toggle the Enable for Organization to ON to apply the SSO settings right away. Leave this OFF if you want to complete any other testing or setup prior to turning on SSO for all your users.
11. Click the Create button. Any group mappings or settings take effect the next time an IdP member signs in.

Refer to the docs for configuring SAML settings for your selected IdP:

• Okta SAML settings
• Microsoft Entra ID SAML settings

Remember that you’ll need the Redox authorization server values (connection name and audience restriction) from the SSO settings in Redox dashboard. The server values are unique to your Redox organization.

This step is only required if you choose IdP-initiated login. For SP-initiated users, skip to step 4.

Follow these steps only after completing steps 1 and 2, since IdP-initiated login requires SP-initiated SSO to already be configured.

1. Talk to your Technical Account Manager to have them enable IdP-initiated login for your Redox organization.
2. Redox configures your organization to accept unsolicited SAML assertions from your IdP.
3. Once enabled, set up an app tile/link in your IdP pointing to your Redox organization. Your users will be able to log in directly from there.
4. After creating the app in your IdP, assign any users to that app to enable them to log in.

Once SSO is successfully enabled in both the Redox dashboard and your IdP, all users must log in with SSO. Any previous Redox credentials will no longer work.

1. Navigate to the Redox dashboard.
2. Enter your email address in the login page.
3. You’re redirected to your IdP for authentication.
   1. If successful, you’re redirected back to the Redox dashboard as a logged-in user.
   2. If unsuccessful, refer to our troubleshooting tips.

Once SSO is successfully enabled in both the Redox dashboard and your IdP, all users must log in with SSO. Any previous Redox credentials will no longer work.

1. Navigate to your IdP.
2. In your app login options, click the Redox tile.
3. Complete your IdP authentication.
4. The Redox dashboard opens with an authenticated session.