SAML Single Sign-On (SSO)¶

Overview¶

SAML SSO is an authentication method that allows you to securely authenticate with multiple applications using one set of credentials. If SAML is enabled and configured in your organization, you can configure an SSO connection directly from ScyllaDB Cloud and allow other users to sign in to your ScyllaDB Cloud account using SAML SSO.

To enable SAML SSO for ScyllaDB Cloud, you will have to:

1. Contact ScyllaDB to have the feature enabled for your ScyllaDB account.

2. Configure your SAML IdP Provider. In this guide, we use Okta as an example.

3. Configure SSO in ScyllaDB Cloud.

Prerequisites¶

• You must have the Admin and SSO roles to configure SSO in ScyllaDB Cloud. See User Roles for details.

• You must have administrator access to your domain DNS records to complete the SSO setup.

Configuring SAML IdP Provider¶

In this section, we’re using Okta as an example IdP provider.

To configure Okta:

1. Create a new SAML application with Okta (IdP) that you can use as the Identity Provider for users. Select SAML 2.0 and click Next.

   

2. In the General Settings tab, enter a name for the SAML App, then click Next.

   

3. In the Configure SAML tab, add the following information (besides the existing defaults), then click Next.

   • Single sign-on URL: https://auth.cloud.scylladb.com/auth/saml/callback

   • Audience URI: scylla-cloud

   • Name ID format: EmailAddress

   • Application username: Okta username

   

4. Navigate to your Okta application, and click the Sign On tab.

   

5. Copy the metadata URL in the Metadata details field and open the URL in the new tab. An XML file will open.

6. Save the XML file locally. You will need it in one of the following steps for configuring SSO in ScyllaDB Cloud.

Configuring SSO on ScyllaDB Cloud¶

To configure SSO:

1. Log into ScyllaDB Cloud. If you have more than one account, ensure you are on the desired account.

2. Go to Settings> SSO.

3. Click Add New to configure an identity provider. You can choose to manually fill out the SSO details or upload a metadata file from your identity provider.

   • Automatic configuration (recommended): Choose AUTOMATIC and upload the XML file you downloaded as the final step of the IdP provider configuration.

   • Manual configuration: Choose MANUAL and enter the SSO Endpoint and Public Certificate from the identity provider. You can find them in Okta by navigating to Applications> ScyllaDB Cloud> Sign On> View SAML setup instructions.

4. Click Proceed.

5. Enter the SSO domain and click Proceed.

6. Copy the Record Name and Record Value values into a new TXT record in your domain DNS records. Then, click Validate.

7. Specify the default SSO role. New users signing up to ScyllaDB Cloud for the first time with the specific email domain will automatically be assigned this role.

8. (Optional) Click Add mapping in the Roles Groups Mapping section to map between your SSO groups and ScyllaDB Cloud roles. The mapping option is available if your organization has a single ScyllaDB Cloud account.

9. Click Done.