# Single Sign-On / RBAC

{% hint style="info" %}
SSO setup requires custom integration. Contact **<support@sedai.io>** for help.
{% endhint %}

Single Sign-on (SSO) streamlines the authentication process for your team and enhances security. Sedai supports two common IdP configurations: [OIDC](#oidc-integration) (OpenID Connect) and [SAML](#saml-integration) (Security Assertion Markup Language). We recommend using OIDC if both options are available.

### IdP Requirements and Sedai Roles

Your IdP must pass role information during the login process. In addition, basic user information (such as full name and email address), should be transmitted for user identification.&#x20;

Sedai provides role-based and group-based access. Role-based access provides access to all resources within a workspace, while group-based access provides access to select [groups](https://docs.sedai.io/get-started/platform/settings/groups) of resources. Role-based Admin can manage roles from Admin > Access Control.

#### Role-based Access

Role-based access provides access to all resources in the workspace. Each team member in a workspace must be assigned one (and only one) of the following:

<table><thead><tr><th width="213">Role-based Access</th><th>Permissions</th></tr></thead><tbody><tr><td><strong>Admin</strong></td><td>Can access all resources, features, integrations, and settings</td></tr><tr><td><strong>User</strong></td><td>Can execute recommendations for all resources but cannot manage any settings</td></tr><tr><td><strong>Viewer</strong></td><td>Can explore recommendations and activity for resources but cannot execute any recommendations</td></tr><tr><td><strong>None</strong></td><td>Cannot view any resources in your workspace, unless group access is defined</td></tr></tbody></table>

#### Group-based Access

Group-based access provides access to select [groups](https://docs.sedai.io/get-started/platform/settings/groups) of resources in a workspace. Each team member can optionally be assigned any combination of the following roles:

<table><thead><tr><th width="219">Group-based Access</th><th>Permissions</th></tr></thead><tbody><tr><td><strong>Admin</strong></td><td>Can manage settings and execute recommendations for resources in select groups</td></tr><tr><td><strong>User</strong></td><td>Can execute recommendations for resources in select groups</td></tr><tr><td><strong>Viewer</strong></td><td>Can explore recommendations and activity for resources in select groups but cannot execute any recommendations</td></tr></tbody></table>

{% hint style="warning" %}
A team member cannot be assigned group-based access with lower permissions than their role-based role. For example, a team member cannot be assigned a Role-based Admin but a Group-based User.
{% endhint %}

***

## OIDC Integration

The following information is required from your OIDC Identity Provider:&#x20;

<table><thead><tr><th width="205">Requirement</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>Discover URI</strong></td><td>Allows Sedai to dynamically discover configuration details of your IdP (typically formatted as <code>https://your-oidc-idp.com/.well-known/openid-configuration</code>)</td></tr><tr><td><strong>Client ID &#x26; Secret</strong></td><td>Establishes secure connection between Sedai and your OIDC IdP</td></tr><tr><td><strong>Roles Mapping</strong></td><td>Maps role names used within your OIDC IdP to Sedai's <a href="#idp-requirements">roles</a> </td></tr><tr><td><strong>Attribute for Role Name</strong></td><td>Indicates specific attribute in your OIDC IdP that holds the role information during the authentication handshake. This attribute should contain the role details corresponding to Sedai's <a href="#idp-requirements">roles</a>.</td></tr></tbody></table>

After our team receives this information, we will provide **Callback URLs** for you to update your OIDC IdP. Sedai uses the URLs to send authentication callbacks. These should be configured to handle responses from the IdP after user authentication.&#x20;

***

## SAML Integration

The following information is required from your SAML provider:

<table><thead><tr><th width="249">Requirement</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>SAML Identity Provider Metadata XML</strong></td><td>Initiates the SAML integration with Sedai by describing your SAML Identity Provider (see <a href="https://en.wikipedia.org/wiki/SAML_metadata#SAML_metadata_examples">example</a>)</td></tr><tr><td><strong>Roles Mapping</strong></td><td>Maps role names used within your SAML Identity Provider to Sedai's <a href="#idp-requirements">roles</a> (SedaiViewer, SedaiUser, SedaiAdmin)</td></tr><tr><td><strong>Attribute for Role Name</strong></td><td>Indicates the specific attribute in your SAML Identity Provider that holds role information during the authentication handshake. This attribute should contain the role details corresponding to Sedai's <a href="#idp-requirements">roles</a>.</td></tr></tbody></table>

After Sedai receives this information, a team members will provide **Sedai's Service Provider Metadata** for you to update your SAML IdP.&#x20;

{% hint style="info" %}
Some SAML providers may allow the use of Service Provider certificate data directly, which is available within the metadata.&#x20;
{% endhint %}

#### Okta SAML 2.0 Configuration

When adding applications in Okta for SAML, you will need to provide the following details to your Sedai support contact:

<table><thead><tr><th width="154">Requirement</th><th>Example</th></tr></thead><tbody><tr><td><strong>Application ACS URL</strong></td><td><code>https://&#x3C;your-domain>.sedai.app/api/saml2/sp?client_name=Sedai-&#x3C;your-domain>-SSO</code></td></tr><tr><td><strong>Application SAML Audience</strong></td><td><code>Sedai-&#x3C;your-domain>-SSO</code></td></tr><tr><td><strong>SSO URL</strong></td><td><code>https://&#x3C;your-domain>.sedai.app/overview</code></td></tr><tr><td><strong>Name ID Format</strong></td><td><p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p><p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p><p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p><p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p></td></tr></tbody></table>

<details>

<summary>How to create managed application in AWS IAM Identity Center</summary>

1. From the AWS IAM Identity Center, click on **Applications** -> **Add Application** and select **I have an application I want to set up**. Choose **SAML 2.0** Application Type.

<img src="https://718462512-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrF70A0mjyczIwzn72g6Y%2Fuploads%2Fh7FRqrUHr2tyV1h6N47u%2Faws-create-iam-group.png?alt=media&#x26;token=31befe02-98d0-41c8-b42d-dc89669fa06a" alt="" data-size="original">

2. Enter Display Name and Description (such as "Sedai" and "Autonomous Cloud Management System").
3. Copy the SAML metadata file URL from the IAM Identity Center metadata section (this URL will be required for loading the IdP Metadata in Sedai; please copy and send to the Sedai team).
4. Under Application Properties, populate the Application Start URL as `https://<your-domain>.sedai.app`. Leave the rest of the fields in the default state.
5. Populate the Application Metadata details:
   * **Application ACS URL**: `https://<your-domain>.sedai.app/api/saml2/sp?client_name=Sedai-<your-domain>`
   * **Application SAML Audience**: `Sedai-<your-domain>`
6. Click **Submit**.
7. Once the application is created, go to the application home page and click **Action** -> **Edit Attribute Mapping**.
8. Populate the attributes as shown in the screenshot below:

<img src="https://718462512-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrF70A0mjyczIwzn72g6Y%2Fuploads%2FgnCADLCv1YPKxZSyJOtj%2Fimage.png?alt=media&#x26;token=f4c086c3-625c-4718-b184-7b5ba3cadf72" alt="" data-size="original">

9. Under the Assigned Users and Groups, add the three groups created in the previous step for this application: SedaiAdmin, SedaiUser, SedaiViewer.
10. Send your Sedai support contact the **SAML metadata file URL** from the IAM Identity Center metadata section and the group IDs for the corresponding Sedai roles.

</details>