Product Documentation

Appearance

EE: All cloud platforms

Single Sign-On ​

To enable Single Sign-On (SSO), Yellowbrick can be configured to use an external identity provider (IDP). Such external providers are necessary to support MFA (multi-factor authentication) which should be in use for all but the most simple trial accounts.

Yellowbrick supports a number of external authentication providers using the OpenID Connect (based on OAuth 2.0) standard. The currently supported list of providers includes:

  • Apple
  • Auth0
  • Microsoft Entra (formerly Azure Active Directory)
  • Microsoft ADFS
  • GitHub
  • GitLab
  • Google
  • Keycloak
  • Okta
  • Salesforce

New providers are being added all the time, so please get in touch if you'd like to see one that isn't on this list.

SSO Configuration Instructions ​

In order to set up an external IDP, use Yellowbrick Manager. Open Yellowbrick Manager, and navigate to the Single Sign-On page as shown in this screen shot:

Click Setup Single Sign-On to continue and follow the wizard to add a new IDP.

Step 1: Choose Your IDP ​

Choose the appropriate external identity provider, and give it a name and identifier. Yellowbrick supports multiple IDPs and the Login page will offer users a choice of which one to use. For that reason, each integration has a user friendly name (the Name field) and a unique identifier to register it with the system (the Identifier field).

Step 2: Configure the IDP ​

To complete this step, you'll need to work with the individual or organization in your company responsible for administration of identity management. Provide them with the Redirect URL shown in this step of the wizard, and ask to to supply you in return the corresponding OpenID Connect parameter values to fill out below.

Note that different providers have different parameters; while all of them have a Client Identifier and Client Secret, others may have various optional fields.

Step 3: Register in the Database ​

The final step of the wizard provides the SQL necessary to add the provider to the database instance. Log in using the credentials supplied for the Administrator Account during installation to execute the SQL provided.

Altering IDP settings requires the Yellowbrick Manager to restart. This only takes 10-20 seconds, doesn't result in any instance downtime, and should be performed immediately so that the newly registered IDP is operational.

See also CREATE EXTERNAL AUTHENTICATION.