SAML¶

Go to Manage > Member Management > SSO Management > User SSO, select the SAML access type, and start adding an identity provider.

Start adding an identity provider¶

1. Identity provider: A platform that provides identity management services, used to manage user identities and authentication information. Define a name here (❗️This name will serve as the IdP alias and appear on the single sign-on IdP selection interface. To ensure you can quickly locate the desired IdP for login, an appropriate name must be provided);
2. Metadata document: The XML document provided by the IdP;
3. Remarks: Custom description information used to record relevant details about the identity provider;
4. Access restrictions: Verify whether the email domain suffix matches the configured domain. Only emails that match will have permission to access the SSO login link. For users logging in for the first time, a Guance member account can be dynamically created without needing to be pre-created in the workspace;

5. Role assignment: Assign roles to SSO accounts logging in for the first time. Accounts that are not logging in for the first time are not affected;

   • If SAML mapping is enabled in the workspace, role assignment will prioritize the mapping rules.

6. Session persistence: Set the inactivity hold time and maximum hold time for SSO login sessions.

For details on role permissions, refer to Role Management.

Obtain Entity ID and assertion address¶

After successfully adding the identity provider, click the Update button on the right to obtain the Entity ID and Assertion Address. Once the corresponding SAML configuration is completed according to the identity provider's requirements, it will be ready.

Session persistence¶

When configuring SSO single sign-on, you can set a unified login hold time for enterprise members logging in via SSO, including the "Inactivity Login Session Hold Time" and "Maximum Login Session Hold Time".

• Inactivity Login Session Hold Time: Supports a range of 180 to 1440 minutes, with a default value of 180 minutes.
• Maximum Login Session Hold Time: Supports a range of 0 to 7 days, where 0 means never timeout, with a default value of 7 days.

Login verification¶

1. Log in via email to access the Guance SSO page: https://auth.guance.com/login/sso;
2. Enter the email address configured during SSO setup and select the IDP of the workspace you wish to log into;
3. After successful authentication, you will be redirected to the workspace selection interface;
4. Log into that address;
5. Enter your username, password, and other required information;
6. Login successful.