Single Sign-On (SSO) is an authentication scheme, allowing users to log-in with a single pair of credentials to multiple, independent software systems.
This article explains the procedure to configure single sign-on to NVIDIA Run:ai using the OpenID Connect protocol.
Before you start, make sure you have the following available from your identity provider:
Discovery URL - The OpenID server where the content discovery information is published.
ClientID - The ID used to identify the client with the Authorization Server.
Client Secret - A secret password that only the Client and Authorization server know.
Optional: Scopes - A set of user attributes to be used during authentication to authorize access to a user's details.
Open the Security section and click +IDENTITY PROVIDER
Select Custom OpenID Connect
Enter the Discovery URL, Client ID, and Client Secret
Copy the Redirect URL to be used in your identity provider
Optional: Add the OIDC scopes
Optional: Enter the user attributes and their value in the identity provider as shown in the below table
Optional: Enable Auto-Redirect to SSO to automatically redirect users to your configured identity provider’s login page when accessing the platform.
If it exists in the IDP, it allows you to assign NVIDIA Run:ai role groups via the IDP. The IDP attribute must be a list of strings or an object where the group names are the values.
If it exists in the IDP, it allows Researcher containers to start with the Linux User UID. Used to map access to network resources such as file systems to users. The IDP attribute must be of type integer.
If it exists in the IDP, it allows Researcher containers to start with the Linux Group GID. The IDP attribute must be of type integer.
If it exists in the IDP, it allows Researcher containers to start with the relevant Linux supplementary groups. The IDP attribute must be a list of integers.
Defines the user attribute in the IDP holding the user's email address, which is the user identifier in NVIDIA Run:ai
Used as the user’s first name appearing in the NVIDIA Run:ai user interface
Used as the user’s last name appearing in the NVIDIA Run:ai user interface
Log in to the NVIDIA Run:ai platform as an admin
Open the NVIDIA Run:ai platform in an incognito browser tab
On the sign-in page click CONTINUE WITH SSO You are redirected to the identity provider sign in page
In the identity provider sign-in page, log in with the SSO user who you granted with access rules
If you are unsuccessful signing-in to the identity provider, follow the Troubleshooting section below
You can view the identity provider details and edit its configuration:
Open the Security section
On the identity provider box, click Edit identity provider
You can edit either the Discovery URL, Client ID, Client Secret, OIDC scopes, or the User attributes
You can remove the identity provider configuration:
Open the Security section
On the identity provider card, click Remove identity provider
In the dialog, click REMOVE to confirm the action
Note
To avoid losing access, removing the identity provider must be carried out by a local user.
If testing the setup was unsuccessful, try the different troubleshooting scenarios according to the error you received.
Troubleshooting Scenarios Error: "403 - Sorry, we can’t let you see this page. Something about permissions…"Description: The authenticated user is missing permissions
Mitigation:
Validate either the user or its related group/s are assigned with access rules
Validate groups attribute is available in the configured OIDC Scopes
Validate the user’s groups attribute is mapped correctly
Advanced:
Open the Chrome DevTools: Right-click on page → Inspect → Console tab
Run the following command to retrieve and paste the user’s token: localStorage.token;
Under the Payload section validate the values of the user’s attribute
Description: Authentication failed because email attribute was not found.
Mitigation:
Validate email attribute is available in the configured OIDC Scopes
Validate the user’s email attribute is mapped correctly
Description: User authentication failed
Mitigation: Validate the the configured OIDC Scopes exist and match the Identity Provider’s available scopes
Advanced: Look for the specific error message in the URL address
Error: "Unexpected error when authenticating with identity provider (SSO sign-in is not available)"Description: User authentication failed
Mitigation:
Validate the the configured OIDC scope exists in the Identity Provider
Validate the configured Client Secret match the Client Secret in the Identity Provider
Advanced: Look for the specific error message in the URL address
Error: "Client not found"Description: OIDC Client ID was not found in the Identity Provider
Mitigation: Validate the the configured Client ID matches the Identity Provider Client ID
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4