Configuration Guide for Cisco Optical Site Manager, IOS XR Release 26.x.x

Single sign-on (SSO)

Updated: October 14, 2026

Want to summarize with AI?

This chapter describes single sign-on in Cisco Optical Site Manager, including SAML configuration, SSO user management, and SSO enablement workflows.

Single Sign-On (SSO) is an authentication process. It enables a user to access multiple applications or services using a single set of login credentials, such as a username and password. This means users authenticate once. They then gain seamless access to all authorized applications without needing to log in separately to each one. The benefits of SSO include:

Eliminates the need to remember multiple passwords.
Reduces the frequency of login prompts during a session.

Configure and enable SSO with SAMLv2

Enable Single Sign-On (SSO) for COSM using SAMLv2. Users can authenticate once through an identity provider (IdP) and then access the system without separate logins.

Only an admin can configure SSO SAMLv2 details.

Before you begin

Log into Cisco Optical Site Manager

Follow these steps to configure and enable SSO SAMLv2 details.

Procedure

Click Users & Access in the left panel.
Click the SSO SAMLv2 section to expand it.
Select the Enable SAML check box to enable the SAMLv2 protocol.
Enter the details as mentioned in the Table 1 table.
Click Apply.

A trust relationship between Cisco Optical Site Manager and the IdP is established, enabling SSO functionality.

For details about each configuration field, see this table.

Table 1. SSO fields
Field	Description
IDP Entity ID	A globally unique identifier for the Identity Provider within an SSO federation. This serves as a distinct name for the IdP, allowing Service Providers to correctly identify and communicate with it.
IDP Metadata URL	The web address that points to the Identity Provider's metadata XML document. Instead of manually configuring the service provider with all the IdP's details, the service provider can simply be provided with this URL.
Proxy Address	The network IP address of a proxy server sits between users and the applications they want to access, typically in an SSO setup.
Proxy Port	Network port number on which a proxy server listens for incoming connections.
Group Attribute Name	Name of an attribute within a SAML assertion or other SSO token that carries information about the user's group memberships.
IDP Metadata	Details that contains all the necessary configuration information about the Identity Provider.

Create an SSO with CAS

Cisco Optical Site Manager administrators can configure SSO users with Central Authentication Service (CAS). This allows a user to access multiple applications with only one login credential.

Only administrators can add new SSO users by specifying the username and assigning a user group, either viewer or editor.

Before you begin

Log into Cisco Optical Site Manager
Ensure that SSO users and other users have unique usernames.

Follow these steps to add an SSO user with CAS.

Procedure

Click Users & Access in the left panel.
Click the SSO CAS section to expand it
Click the + button.

The Create SSO User dialog box appears.
Enter the username in the Username field.

Select a user group from the Group drop-down list.


Group	Description
editor	When mapped for SSO, can only view the Cisco Optical Site Manager configurations.
viewer	When mapped for SSO, can configure devices.

Click Apply.

A confirmation message appears.
Click Yes.

The SSO user is successfully created.

Enable an SSO with CAS

Cisco Optical Site Manager administrators can configure SSO users with a Central Authentication Service (CAS). This allows a user to access multiple applications with only one login credential.

Only administrators can enable SSO with CAS on Cisco Optical Site Manager.

Before you begin

Log into Cisco Optical Site Manager

Follow these steps to enable SSO with CAS:

Procedure

Click Users & Access in the left panel.
Click the SSO CAS tab.
Click SETTINGS to expand it.
Select the Enable CAS check box.
Enter the Cisco Optical Network Controller server IP address in the IP Address field.
(Optional) Specify the port number in the Port field.

The default port number is 443.
Click Apply.

A confirmation message appears.
Click Yes.

SSO with CAS on Cisco Optical Site Manager is successfully enabled.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.