An optional package allows clients to add Single Sign-On (SSO) authentication to Control Center for a fee. This gives you the ability to have your organization’s users sign in to Pismo Control Center through an Identity Provider (IdP) using a single set of credentials. Pismo supports SSO with the Security Assertion Markup Language (SAML) 2.0 protocol. Any identity provider that supports SAML 2.0 works with Pismo. The advantage of this is that your IdP acts as a trusted service that manages user accounts and their authentication.

📘

Single sign-on (SSO) is only available to customers who have purchased it. Contact your Pismo representative for more information.

How SSO with SAML work with Control Center

This is the basic log in and authentication flow when a user accesses the Pismo Control Center with SAML SSO configured:

1. User navigates to Control Center to login using SSO.
2. User enters their email address and Control Center determines if this email domain uses an SSO profile to authenticate. If the email domain has a rule to use SSO, the SAML request for login is sent to the identity provider (IdP).
3. User logs in to the IdP.
4. The IdP prepares a SAML response and sends it to the user's browser.
5. The IdP posts the SAML response to Control Center, and the user is directed to their unique Control Center homepage.

Configure SSO for SAML

🚧

Before you start your configuration, you must ensure your IdP supports SAML 2.0.

If you are unfamiliar with SSO or SAML, refer to the Terms to know section before proceeding with the configuration steps.

Step 1: Set up your identity provider (IdP)

1. Log in to your IdP admin console—access your IdP (e.g., Okta, OneLogin, Entra ID, Google Workspace, etc.).

2. Create a new SAML application—create an application in your IdP that represents the relationship between Control Center and your IdP.

   1. Navigate to the console section where you can add a new application.
   2. Select SAML-based authentication.

3. Configure basic application settings.

   1. Provide a name and description for the SAML application.

   2. Optionally, upload a logo for easier identification.

   3. Configure SAML Settings—you will see a screen like this (actual layout is dependent on your chosen IdP):

      

   4. Enter the IdentifierIdentifier (Entity ID) provided by Pismo. This is a unique identifier for the service provider (the application a user wants to access—in this case, Pismo Control Center), often a URL or a URN.
      Note: this URL or URN is unique to each environment (one for production, one for test, and so on).

   5. Enter the URL provided by Pismo where Control Center will receive SAML assertions from the IdP into the Reply URL (Assertion Consumer Service URL) field.
      Note: this URL is unique to each environment (one for production, one for test, and so on).

4. Map Attributes—(e.g., email, first name, last name) from the IdP to the SP. The following attributes are required:

   • Username—email address (string)
   • Name—In Control Center, there is a single field for name and you can send anything you want for this field (first name + last name, first name only, display name and so on). (string)
   • Email address—user email address (string)

5. Select Unique User Identifier—this is a default claim that is added when an app is created.

   • Namespace— http://schemas.xmlsoap.org/ws/2005/05/identity/claims
   • Source—Attribute
   • Source attribute—user.email

6. Download IdP metadata SAML certificate—Download then save the IdP metadata XML file. This is required for Control Center configuration.

Step 2: Send IdP configuration information to Pismo

You must send the IdP metadata XML file you downloaded in the previous step to Pismo. Do this through a secure Enhanced File Transfer (EFT).

1. Pismo will send you an email invite to register to the EFT. Note: If you are already registered, connect to the online EFT Portal.
2. Log in to your account using the email account and password you created when you registered to the EFT.
3. Select the Shared with Me folder and then select the folder that was shared with you by Pismo.
4. Upload the metadata XML file.

Step 3: Assign Roles in Control Center

With the optional package that allows you to set up Single Sign-On (SSO) authentication to Control Center, you can also set up role mapping in Control Center. Role-based access control (RBAC) enforces the principle of least privilege. With RBAC, users are granted only the minimum access necessary for their roles. Control Center users can be assigned to multiple roles, each with different permissions. If you have multiple organizations, your users can be assigned to different roles for each organization. For example, a user can be an Admin in organization 1 but an Accounts viewer in organization 2.

Integration flow with role mapping

Once you have configured the role mapping for your users, this is the authorization flow for users when logging in to Control Center:

1. User logs in via the IdP.
2. IdP sends an authentication token with attributes.
3. Control Center reads the attributes:
   1. Identifies the user via email
   2. Determines access levels via the custom attribute
4. Permissions are applied based on the received values.

To create the role mapping for your users, you need to provide SAML assertions. The assertions must be provided in a very specific format: OrgID/rolename (for example: TN-123456789/controlc-admin).

• OrgID is mandatory—This is because you may have more than one organization in Control Center and users can be assigned separate roles for each organization.
• Rolename must be the exact name of the role—Only those roles in the table above are allowed, you cannot add new roles or modify the pre-defined role names.
• You can send multiple roles in the SAML assertion—either as a semicolon-separated list in a single SAML attribute or as a multi-value SAML attribute.

Configure a user role in Entra ID

To enable Control Center to interpret access levels, you must configure a user role in Entra ID, which is a 4-step process:

• Create groups
• Add roles
• Assign roles to the groups
• Edit attributes and claims

Create groups

Create custom groups for Pismo roles and assign your team members (users) to these groups. You can assign a Pismo role to each group and you can add users to multiple groups.

1. Log in to the Entra ID Dashboard.
2. From the left navigation panel, select Groups.
3. Select Add new group:
   1. Group type—select Security
   2. Group name—enter the name of the group (for example, Setup viewer)
   3. Select No members added and add users to the group

Add roles

Custom roles are not supported within Control Center. Role management is restricted to the following pre-defined roles. Refer to the Control Center User permissions and roles guide for permission details for each of the roles.

To create the role mapping for your users, you need to provide SAML assertions. The assertions must be provided in a very specific format: OrgID/rolename (for example: TN-123456789/controlc-admin).

• OrgID is mandatory—This is because you may have more than one organization in Control Center and users can be assigned separate roles for each organization.
• Rolename must be the exact name of the role—Only those roles in the table above are allowed, you cannot add new roles or modify the pre-defined role names.
• You can send multiple roles in the SAML assertion—either as a semicolon-separated list in a single SAML attribute or as a multi-value SAML attribute.

Take the following steps to add roles:

1. Go to Entra ID > App registrations.

2. Select the application you created for the Pismo Control Center.

   1. Go to Manage > App roles.

   2. Select Create app role.

      

   3. In the Create app role pane:

      • Add a Display name

      • Add Allowed member types

      • Add a Value—this value must follow the orgId/Role name pattern

      • Enter a Description

      • Select Apply.

        

Assign roles to Entra ID groups

1. Go to Enterprise applications and open the App created for Pismo Control Center.
2. Go to Manage > Users and groups.
3. Select Add user and groups.
4. Under  Add users and groups select None Selected to add a group. A list of users and security groups displays.
5. You can search for a group you created in the previous step and select the groups that display in the list. Choose Select to proceed.
6. Under Select a role select None Selected. All the roles that you defined for the application are displayed.
7. Select a role and choose Select .
8. Select Assign to finish the assignment of users and groups to the app.

Edit attributes and claims

1. Go to Manage > Single-sign on.
2. In the Attributes & Claims section, select Edit.
3. Add a new claim for the role:
   • Name—ControlCenterRole
   • Namespace—(if required) http://schemas.xmlsoap.org/ws/2005/05/identity/claims
   • Source—Attribute
   • Source attribute—user.assignedroles
4. Save the configuration and ensure the claim is included in the token sent to Control Center.

Step 4: Finalize the configuration in the IdP

Once Pismo receives the metadata file, we will complete your configuration and notify you when the system is ready to test. Once you are notified that configuration is complete, do the following:

1. Test the configuration.
   1. Ensure that user attributes are correctly mapped.
   2. Perform a test login to verify that SSO is working as expected.
2. Enable SSO for users.
   1. Once testing is successful, notify Pismo and we will enable SSO for your users in your email domain.
   2. Add users into your IdP (refer to the next section for special considerations when creating users with SSO).
   3. Provide necessary documentation or training to your end-users on how to use SSO.

Considerations for creating users with SSO integration

There are some specific considerations for Control Center administrators when creating users with SSO integration. The main thing to keep in mind is that while you must initially create all your users in your IdP, you must manage Control Center users and user roles from the Control Center.

If you have a user in your IdP but you haven’t created a user for that person in the Control Center, this is what happens when they log into the Control Center for the first time using SSO:

1. When a person without a defined user account in Control Center logs into Control Center for the first time, a user account is automatically created using Just-in-Time (JIT) provisioning from SAML.
2. Since the newly assigned user does not yet have a role assigned, they will not have permissions to see anything in Control Center upon initial log in. They will be directed to a page telling them to reach out to their company Control Center admin to have roles assigned.
3. As the company Control Center admin, you must log in to Control Center to assign the appropriate roles to the user.
4. The next time the user logs into Control Center, they will have the correct access.

User deletion and revoking access to Control Center

Control Center users are not synced with users in your IdP. Therefore, Pismo does not get notified if user access is revoked in IdP. So, user deletion for Control Center is a two-step process.

First, you must revoke user access in your IdP. If users try to log in to Control Center again through SSO after their current session expires, Pismo revokes their access but does not delete the user.

Next, you need to delete the user in Control Center to remove the user, so that user does not count towards your user account limit. Note that users that were created in Control Center before the integration was turned on will still be shown as users in Control Center even If you never granted them access in your IdP.

Terms to know