When logging into and using Sitecore Content Hub, it is possible to work with the single sign-on mechanism. Here, we introduce the actual verification procedure for single sign-on using the SSOCircle mechanism.
![](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F2lOovPEIiAENIEEnJBTPzr%2F456e5a51f38f424a1955279083df24f2%2Fssocirclemetadata1.png&w=3840&q=75)
Verification using SSOCircle
In this case, SSOCircle makes it easy to verify SAML authentication.
Create an account
Please create an account when you use the service for the first time.
![ssocircleregist.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F6nMnLWXZ9oOEij4spalvr5%2Fb0a78092207ee898117b610c6c74eb94%2Fssocircleregist.gif&w=3840&q=75)
After completing registration, an email containing the URL for activation will be sent to the registered user's email address a short time later. Clicking on the URL in the e-mail will activate your account.
![ssocircleactivate.png](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F1ZYPFWxoJuQfUf6gwOWaPB%2Fd0896e577e5aba52c88bd158d2fc44ca%2Fssocircleactivate.png&w=3840&q=75)
Now that your account has been activated, you can actually log in.
![ssocirclelogin.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F7vjDvVeThGxSuc9nqFS2Zr%2F9efc277a206eda7cb46fa3e0a5343f01%2Fssocirclelogin.gif&w=3840&q=75)
Once you have logged in, your account creation is complete.
Meta data registration
We will proceed with the settings related to the service provider. On the left side menu of the login screen, there is a `Manage Metadata` item. Clicking on it will take you to the following screen.
![ssocirclemanagemetadata.png](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F3QBNtGwcqjXZ067J5MhN0D%2F52fcfa93ae6f6424caf6c21e543da068%2Fssocirclemanagemetadata.png&w=3840&q=75)
This time, to add a service provider, click on the `Add new Service Provider` item listed at the top.
![ssocirclemetadata1.png](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F2lOovPEIiAENIEEnJBTPzr%2F456e5a51f38f424a1955279083df24f2%2Fssocirclemetadata1.png&w=3840&q=75)
As for the contents displayed on this screen, please enter the following 2 first.
- FQDN Enter the FQDN of the Sitecore Content Hub
- Attributes sent in assertition Check two items: UserID and EmailAddresss.
![ssocirclemetadata2.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2FX1q9iV0lr5VJX1P7R1gbP%2Fa917216b9a03fc53ce747d78425ec37b%2Fssocirclemetadata2.gif&w=3840&q=75)
You will need to provide the SAML Meta data listed below, and the instructions for generating this code can be found on the screen by clicking you can build it here.
When the screen switches, you will be prompted to enter the following two items.
- EntityID
- ACS URL
The EntityID should be the URL of the server. In this case, the / must be set at the end. Next, for ACS URL, enter the URL with AuthServices/Acs added to the EntityID URL. After entering the above two items, click the "insert" button to complete the Meta data.
Register the resulting metadata on the original page and click the Submit button to complete the process.
![ssocirclemetadata3.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F6ROO4Ehw7ZczVal6fQ300u%2Ffd072434fb4e51a79d07f9e9a2f35461%2Fssocirclemetadata3.gif&w=3840&q=75)
This completes the SSOCircle configuration.
Preparing the Sitecore Content Hub environment
The following steps will be used to change the mechanisms related to authentication.
Change login mode from Active to Passive
Sitecore Content Hub sandbox environments may be deployed in a way that works only with the standard single sign-on provided.
To change this setting, follow the steps below to modify the parameters.
- Open the tool Manage
- Check settings Open Settings
- Type Auth in the search box to find Authentication under the PortalConfiguration section
- Authentication を開きます
- Change the display mode from Tree to Text.
- If authentication_mode is Active, change it to Passive
If authentication_mode is already set to Passive, do not change it and continue.
![ssopassivemode.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F3ha6aWKjVS588meoJnqL7k%2F70b4f0bfb8a752e1ea1a42677f22d367%2Fssopassivemode.gif&w=3840&q=75)
After changing the setting, a login dialog box will appear.
![ssologinbox.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F8eHrK8eZ2ae34ed5PUjUM%2F2d9b4916c819e94c99cfebd5afd95df3%2Fssologinbox.gif&w=3840&q=75)
Check if you can log in as an administrator.
Create an account that allows you to log in as an administrator. If you have already logged in as an administrator from the above screen, you can bypass this step. Creating an account and setting a password will be introduced separately at a later date.
Reflecting SSOCircle settings
We will change the already configured authentication settings to the SSOCircle settings for verification. Once again, we go to the Authentication settings page and look at the code as follows.
"Providers": [
{
"$type": "Stylelabs.M.Portal.Authentication.SamlAuthenticationProviderConfigurator, Stylelabs.M.Portal",
"metadata_location": "https://stylelabs.eu.auth0.com/samlp/metadata/JyVO5bQjk6n3mrUJnUZ02vMuA1K4MiaY",
"sp_entity_id": "urn:stylelabs.eu.auth0.com",
"idp_entity_id": "urn:stylelabs.eu.auth0.com",
"provider_name": "SSO",
"authentication_mode": "Passive",
"module_path": "AuthServices",
"is_enabled": true
}
],
The login screen provided in this configuration is as follows
![ssologinbox1.png](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2Fi3RXfXmoe1gzX62kOPo0R%2F399d04cb86470756c852352cce7c20cd%2Fssologinbox1.png&w=1920&q=75)
In order to use the login mechanism in conjunction with SSOCircle, the following items should be changed regarding parameters.
Parameter | Value |
---|---|
metadata_location | |
sp_entity_id | Provide the URL of the instance |
idp_entity_id | Get from SSOCircle site |
provider_name | Change name to SSOCircle |
To obtain the value of idp_entity_id, access the URL _metadata_location_ and quote ipd_entity_id in the first line of the XML. Here the value is as follows
![ssoentityid.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F495V9tETJ69TxKzn4MQJFv%2F5bce86b56f465dc7c265afb279f98770%2Fssoentityid.gif&w=3840&q=75)
As a result, the following parameters are set
Parameter | Value |
---|---|
metadata_location | https://idp.ssocircle.com/meta-idp.xml |
sp_entity_id | https://jpntraining09.stylelabs.io/ |
idp_entity_id | https://idp.ssocircle.com |
provider_name | SSOCircle |
{
"$type": "Stylelabs.M.Portal.Authentication.SamlAuthenticationProviderConfigurator, Stylelabs.M.Portal",
"metadata_location": "https://idp.ssocircle.com/meta-idp.xml",
"sp_entity_id": "https://jpntraining09.stylelabs.io/",
"idp_entity_id": "https://idp.ssocircle.com",
"provider_name": "SSOCircle",
"authentication_mode": "Passive",
"module_path": "AuthServices",
"is_enabled": true
}
In addition, to link with SSOCircle, please change the following three items.
"UsernameClaimType": "UserID",
"EmailClaimType": "EmailAddress",
"PostSignOutRedirectUrl": "/en-us/account",
![ssosetssocircle.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F47D9dyGRMcmochWLHs1fuD%2Fffb626294f901c0ee4de2ebeac5d62e2%2Fssosetssocircle.gif&w=3840&q=75)
After completing the setup, log out and you will see the button added to the login box as shown below.
![ssologinbox2.png](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F6spL9SubycldgZzj4apIMY%2Fa03c0b76079ecb8e9141a89cfde669cd%2Fssologinbox2.png&w=1920&q=75)
Single sign-on validation
If you have a browser that is logged into SSOCircle to validate single sign-on, please log off the browser (due to limitations for free plans).
- On the login screen, click the SSOCircle button
- SSOCircle login screen will be displayed
- Log in with the account you have previously created
- You can login to the Sitecore Content Hub
Please set user privileges after logging in, as only general user privileges are granted at the login stage.
![ssosignin.gif](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fzi1ovlormku8%2F6l65QpX0MyCpiNBrdWOhSd%2F4091fccf42980a9a2527ecd45c99f343%2Fssosignin.gif&w=3840&q=75)
Summary
This time, we used SSOCircle to verify the implementation of single sign-on, that is, we confirmed that it is possible to log in using an account created with SSOCircle. In case of actual SSO implementation, you need to implement it according to the mechanism you are using.