Single-Sign-On
Allow single sign-on for users on an Exoscale account using an Open ID Connect, also known as OIDC. identity provider. SSO organization connect for Exoscale is available to every organizations.
Activation
Accessible to users with OWNER user role in the IAM section of the main navigation, under SSO.
Configuration
Accessible to users with OWNER user role in the IAM section of the main navigation, under SSO.
You need to enter:
- your OIDC
Client ID - the OIDC
Issuer URL - your OIDC
Client Secret
This is the URL you need to authorize on the OIDC provider side: https://portal.exoscale.com/sso-authenticate/<sso-org-name>
Login
The URL for the SSO login page: https://portal.exoscale.com/sso-login/<sso-org-name>
When a user logs in an organization using SSO, a new, unique user is created inside this organization with the TECH role.
The username is a universally unique identifier (or UUID) to allow for a standard non-SSO user with the same email address.
How SSO users work
When a user successfully authenticates through the configured OIDC provider, Exoscale creates a dedicated SSO user inside the organization.
An SSO user is different from a standard Exoscale user:
- it is created automatically on the first successful SSO login;
- it does not require a local Exoscale password;
- its authorization is controlled by the configured OIDC provider and the CEL authorization expression.
Internally, SSO users are identified independently from standard Exoscale accounts, even if both share the same email address.
SSO users are organization-specific
An SSO user belongs to the organization where it was created.
If another organization also wants to use SSO authentication, SSO must be configured independently for that organization.
An SSO user created in organization A cannot be reused automatically in organization B if organization B does not use SSO.
Authorization
You can authorize in two ways:
- Use an ID token introspection with a Common Expression Language (or CEL) query.
- Set up your own proxy with a DEX server or equivalent.
Authorization with ID token introspection
Enter two values to perform ID token payload introspection to authorize a user:
OIDC Additional Claimswhich contains claim names (space separated)- a
Common Expression Language Authorization Expressionwhich is evaluated at login time against the ID token payload.
OIDC additional claims
The standard claims which are always part of the ID token payload are:
openidprofileemail
If you need to introspect additional claims, you need to enter them in the OIDC Additional Claims field.
Common Expression Language Authorization Expression
This Common Expression Language query will be evaluated at login time against the ID token payload.
The CEL authorization expression must return the UUID of the desired IAM Role for the user.
email.endsWith('@exoscale.com') ? 'dc097e90-4636-4d2a-a629-670ab4395209' : falseThe role of the SSO users will be updated accordingly over time with the return value of the CEL expression. This means that by updating the IAM Role UUID in the above example, the user would be assigned to it.
Any return value that is not a valid IAM Role UUID will deny access to the platform.
Interaction with Two-Factor Authentication
SSO and 2FA are complementary features.
Standard authentication
Users authenticating with an Exoscale username and password can enable Two-Factor Authentication on their account.
If an organization enforces Two-Factor Authentication, those users must complete the TOTP challenge before accessing the organization.
SSO authentication
Users authenticating through SSO do not use an Exoscale password.
Authentication is delegated to the configured OIDC provider.
If the identity provider already enforces Multi-Factor Authentication, users complete MFA on the provider side before being redirected back to Exoscale.
Mixed environments
It is possible to use both authentication methods within the same organization.
Removal of SSO users
Every time a new SSO user is recognized by Exoscale, a new special account is created on the platform. You can see all of your Organization’s users in the user management view in the web portal: IAM > Users.
In order to fully remove a SSO user, it is not enough to remove it from your Exoscale Organization, you will also need to prevent his ability to login via the OIDC provider, or the user will simply be recreated at its next login.