How to Activate Single Sign On (SSO) in RMS

Overview

Single Sign On (SSO) allows users to access multiple applications using a single login with an Identity Provider.

Single Sign On (SSO) centralises user authentication to a single Identity Provider (IdP) that can provide access to multiple configured applications.

Activating SSO in RMS will require users to be authenticated by the Identity Provider to access RMS.

Important! RMS must be set up in the Identity Provider before activating SSO in RMS. Activating SSO in RMS without completing the necessary setup in the IdP will lock all users out of RMS.

Setup

The following setup will need to be completed by the IT Administrator and an RMS System Administrator.

Step 1 - Add RMS in the IdP

This step is performed outside of RMS and should be completed by the IT Administrator.

Add RMS as a SAML Application or Endpoint with the Identity Provider (IdP) using the information below.

RMS Entity ID: https://app.rmscloud.com

RMS Digital Registration Card Entity ID: https://app12.rmscloud.com/sso/ClientID?appId=13

RC Assertion URL: 

• https://rcapp.rmscloud.com/SAML/Assertion

Beta Assertion URL: 

• https://betaapp.rmscloud.com/SAML/Assertion

   

Login URL: 

• https://app.rmscloud.com/sso/ClientID

   

Attributes

• Name: ClientID
• Value: Your RMS Client Number

Please Note! Replace ClientID with the property's RMS Client ID. For Enterprise Properties, this is the Owner's RMS Client ID. 

Tip! SSO can be configured separately for the Beta and RC environments.

Tip! The complete property-specific URL can be obtained by logging into RMS using an Internet Browser and copying the URL after successful login.

Please Note! IT Administrators should consult the documentation of their Identity Provider for further assistance with this step.

Important! Complete the following before continuing: 
✓ Add RMS to the IdP
✓ Test SSO Login in the IdP
✓ Download the Issuer Certificate

Step 2 - Setup SSO in RMS

After RMS has been added to the Identity Provider, SSO can be activated in RMS.

Selecting the SSO Username Type as 'Federation ID' will require a Federation ID to be setup on all RMS Users before continuing.

Please Note! SSO cannot be trialled independently in the RMS Training Database.
Use the 'Test Login' or 'Test Application' feature within the IdP to ensure RMS has been added correctly prior to activating SSO in RMS.

Have your System Administrator complete the following.

In the side menu of RMS, go to Setup > Security.

1. Navigate to the 'SSO' tab.
2. Select the '+' (Add) icon to open the SSO Configuration dialog (or select an existing environment row and click the pencil edit icon to update it).
3. Select the Environment. 

Please Note! New SSO configurations can be created for Beta and RC only.

1. Toggle 'SSO Enabled' on.
2. Enter the Issuer.
3. Upload the Identity Provider Certificate.
4. Enter the Login URL.
5. Enter the Logout URL.
6. Select the SSO Username Type.
7. Select the SSO Username Location.
8. Optional: Enter the Attribute Name (required if 'Username is in an attribute element' is selected).
9. Optional: Enter the Name ID format.
10. Select 'Save/Exit'.
    

Please Note! New SSO configurations can only be created for the Live and RC environments. If an existing SSO configuration for Beta or another legacy environment is already in place, it will remain visible in the list and can be viewed, disabled, or deleted - but cannot be recreated once removed.

Important! Users will be locked out of RMS if the appropriate setup and testing have not been completed in the IdP before saving.

Please Note! Identity Provider Certificates will be in the file format of .txt, .cer, or .pfx.
Selecting the SSO Username Type as 'Federation ID' requires a Federation ID to be setup on all RMS users before continuing.
Selecting the SSO Username Location as 'Username is in an attribute element' requires an Attribute Name to be specified.

Finished

SSO is now active in RMS.

Users will need to be logged in and authenticated with the Identity Provider to gain access to RMS.

Tip! Use the URL below in the Internet Browser to access the RMS Training Database when SSO is active in RMS.
Replace ClientID in the URL below with the property's RMS Client ID.

https://app.rmscloud.com/sso/ClientID/training