Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

PowerScale OneFS 9.8.0.0 Web Administration Guide

PDF

Single sign-on overview

OneFS supports single sign-on (SSO) authentication to the WebUi using a third-party system as the SSO Identity Provider.

SSO enables a user to access multiple independent systems after authenticating to an Identity Provider.
NOTE:Configuring OneFS to participate in SSO is not the same as configuring OneFS to use an external authentication provider domain to authenticate users. For that solution, see the section "Supported authentication providers".

Two components are involved in the SSO solution.

  • The Service Provider (SP) provides services to users. Users must authenticate to gain access. If SSO is configured, the Service Provider sends requests for authentication to an external system rather than prompting the user for credentials.
  • The Identity Provider (IdP) is the external system that performs authentication on behalf of other systems.
    NOTE:The IdP is external to OneFS and is not provided by Dell.

In the OneFS SSO solution:

  • OneFS is the SP that forwards authentication requests to a third-party IdP.
  • In OneFS, the verified IdP is Active Directory Federation Services (ADFS). Other IdPs may work.

The SSO configuration procedures describe how to configure OneFS and ADFS to work together to provide SSO authentication. Each system needs information about the other one. The procedures assume that you are using ADFS as the IdP and that you already have it configured and running.

SSO user experience by access zone

OneFS SSO is configured and enabled separately for each access zone.

SSO is configured separately for each access zone. Each access zone can have SSO enabled or disabled separately. For each access zone that has SSO enabled, you must configure an IdP You can use the same or different IdP for each zone. Each zone can have only one IdP.

When SSO is enabled on a zone, the Log in with SSO link appears on the OneFS WebUI login screen. When a user clicks that link, OneFS sends a SAML request to the SSO IdP. One of the following occurs:

  • If the user has already logged into the SSO IdP, the IdP returns an authentication token to OneFS. The user gains access to the OneFS home screen.
  • If the user has not logged into the SSO IdP, the user is redirected to the IdP login screen and logs in. If the login is successful, the IdP returns an authentication token to OneFS. The user gains access to the OneFS home screen.

If the signing certificate required for communicating with the IdP expires, OneFS disables SSO. An authorized administrator can regenerate an expired certificate on the WebUI, using Access > Authentication providers > SSO > <access-zone>.

SSO with MFA

To combine single sign-on with multifactor authentication (MFA), you must configure the MFA feature in the IdP, rather than in OneFS.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\