Common SSO Options

Edit the main configuration file conf/config.yml to fine tune behaviour of the application when using any SSO providers.

Two groups of keys live under loginMethodConfigurations. The first switches each authentication method on or off.

Configuration key	Description	Example	Default
`formLogin → enabled`	Whether the application can be accessed via username and password authentication	`false`	`true`
`apiKeyAuth → enabled`	Whether the application can be accessed via an API key authentication	`true`	`false`
`saml → enabled`	Whether the application can be accessed via SAML authentication	`true`	`false`
`openIdConnect → enabled`	Whether the application can be accessed via OpenID Connect authentication	`true`	`false`

The second group, under commonSSOOptions, applies to every SSO provider.

Configuration key	Description	Example	Default
`autoCreateUsers`	Whether SSO access also creates the user in the application. Disabling it prevents the login of any user that is not already in the application.	`false`	`true`
`autoCreatedUsersEnabled`	Whether users created by SSO access start enabled or disabled. Only has an effect when `autoCreateUsers` is `true`. See Disabled auto-created users.	`false`	`true`
`autoCreatedUserType`	The user type given to automatically created SSO users. See User types for SSO users.	`analyst`	`unrestricted`
`mandatoryGroupName`	A group that every user must belong to, as provided by the SSO. See Mandatory group.	`groupName`	n/a
`ssoLogoutUrl`	The URL the application redirects to after the user clicks the logout button. Preferably the SSO’s own logout endpoint, so the user is logged out of both the application and the SSO system.	`https://samlserver.example.com/logout`	The application’s login page
`requiredGroupNamePrefixes`	Filters out groups in an SSO response that do not carry one of the listed prefixes. See Required group name prefixes.	`AllowedPrefix1_`	n/a

Disabled auto-created users

An administrator can manually enable such users in the application’s user management.

User types for SSO users

There are four user types. Each accepts more than one spelling for autoCreatedUserType, and the value is case-insensitive:

User type	Accepted values
Analyst / Basic	`analyst`, `basic`, `reader`
Simulation	`simulator`
Model	`modeler`
Unrestricted	`unrestricted`, `admin`

The number of users per type is limited by the license. A user type does not grant any access rights or roles by itself — it only limits the access rights or roles a user can be given. See Licenses, User Types and Access Management for what each type can do.

An unrecognized value does not stop the server: the user is created as the Analyst / Basic type and a warning is written to the log. If auto-created users come out with fewer rights than expected, check the value against the table above.

Mandatory group

Use this option when all users need to belong to the same group. It has no effect if synchronization is not enabled in the specific SSO configuration. If the SSO provider does not return the mandatory group for a user, that user cannot log in.

Required group name prefixes

If one or more prefix values are set, any group that matches none of them is treated as if it were not present in the SSO response. If no values are given, all groups are treated as valid.

When mandatoryGroupName is also set, the mandatory group name must itself carry at least one of the prefix values.

This option is available since 6.0.0 and is optional.