Cisco Cyber Vision Classic UI Administration Guide, Release 5.6.0

PDF

Cisco Cyber Vision Classic UI Administration Guide, Release 5.6.0

Single sign-on (SSO)

Updated: July 6, 2026

Want to summarize with AI?

Log in

Introduces SSO as an authentication mechanism enabling access to multiple applications with a single login, details its security benefits, outlines SAML 2.0 support, and describes centralized authentication, federated service provider integration, and improved user experience.

Single sign-on (SSO) is an authentication mechanism that

  • allows users to access multiple applications using a single set of credentials,

  • reduces the need for multiple logins and password management, and

  • enhances security by centralizing authentication.

Table 1. Feature History Table

Feature

Release Information

Feature Description

SAML 2.0 SSO authentication support

Release 5.3.x

Cisco Cyber Vision Center supports SAML 2.0 SSO authentication.

Central authentication and authorization

This security mechanism uses a central identity provider (IdP) to manage user credentials and access permissions across multiple platforms. It consolidates authentication into a streamlined process.

Federated service provider applications

Applications configured to work with SSO, allowing users to access resources through federated authentication.

Additional reference information

With SSO, a user logs in once to access all authorized service provider applications without re-entering credentials, resulting in improved user experience and streamlined access control.

SAML single sign-on

SAML single sign-on is an authentication approach that:

  • enables users to authenticate once and gain access to multiple applications through a central identity provider,

  • uses Security Assertion Markup Language (SAML) 2.0 to securely exchange authentication and authorization data, and

  • eliminates the need for repeated login credentials for each service.

After successful authentication by the identity provider (IdP), users are redirected back to their service. The browser manages all communication between the service and the IdP. As a result, services such as Cisco Cyber Vision Center do not require a direct network connection to the IdP.

SAML single sign-on integration references

The Cisco Cyber Vision Center supports SAML single sign-on with any single sign-on provider that uses the SAML 2.0 standard, such as the following:

Requirement: SSO configuration for Cisco Cyber Vision Center

Ensure that you meet these requirements when configuring SSO for Cisco Cyber Vision Center:

  • Only admin users authenticated internally can configure SSO.

  • Use only one SSO provider at a time (for example, Azure or Duo).

  • Initiate SSO only from the Cisco Cyber Vision Center, not from the identity provider (IdP).

  • Review audit logs to monitor login and log out events for SSO. The Cyber Vision Center records and sends these events through syslog.

  • Ensure that the Cyber Vision Center host name (FQDN) is DNS resolvable.

  • A center can only be configured with SSO if LDAP is disabled or not configured.

Single sign-on user accounts

A single sign-on (SSO) user account is a user identity credential that:

  • allows access to multiple applications, systems, or services with a single set of login credentials,

  • uses a central identity provider (IdP) to handle authentication, and

  • simplifies the user experience by removing the need for separate logins for each system.

Role and configuration of SSO accounts

The identity provider (IdP) manages users and groups directly or imports them from external directories such as Active Directory, RADIUS, or LDAP. The IdP sets most account details for SSO users, including usernames and passwords.

A single sign-on account appears on the Cisco Cyber Vision Center users page only after the user has logged in successfully for the first time.

Both single sign-on accounts and the NameID attribute provided by the IdP during SAML login require valid email addresses. By default, many IdPs use the user's username as the NameID attribute. Confirm your IdP's behavior when configuring it and when creating user accounts for SSO access to Cyber Vision Center.

User role mappings for SSO users

Role mappings for SSO users are configuration mappings that:

  • associate user groups from an identity provider (IdP) with roles in the Cyber Vision Center,

  • use role attributes to determine user permissions dynamically, and

  • enable centralized management of user access through SSO integration.

Coordination and configuration details

The following guidelines apply to coordinating with your IdP and managing role attributes:

  • Role assignment: Set up user roles at the Cyber Vision Center and coordinate them with your SSO IdP application settings. Assign roles to groups defined in the IdP.

  • SSO federation understanding: Review how users, groups, and roles are organized in your IdP and configure user role mapping effectively. Consult the IdP vendor documentation for guidance on creating or importing users or groups.

  • Role attribute at the IdP: The IdP sends a role attribute, which lists the groups a user belongs to in the IdP.

  • SSO configuration details: The SSO configuration specifies the name of the role attribute and includes a list of expressions mapped to Cyber Vision Center user roles.

Provide the email address attribute only if you need to migrate local users to SSO. When you configure SSO with the email address attribute, the system identifies the logged-in user's email address from the SAML assertion. If a user exists with that email address, the system removes that user from local authentication. Afterward, the user can only log in with SSO. If needed, create a new internal user.

Microsoft Entra ID single sign-on integrations

A Microsoft Entra ID single sign-on integration is an authentication solution that

  • uses Microsoft’s multi-tenant, cloud-based Azure Active Directory to manage user identities,

  • enables secure and centralized access to both cloud and on-premises applications (such as Cyber Vision Center), and

  • allows users to authenticate with a single account across multiple services through federation.

Within Azure, a tenant is an entity that manages joined devices for one or more organizations. With a single sign-on account, you can access these devices seamlessly. Familiarize yourself with the Azure tenant structure before onboarding applications like Cyber Vision Center.

Add an enterprise application to your Azure tenant

Allow integration of external services or custom apps with your organization's Azure environment.

Before you begin

Procedure

  1. Sign in to the Microsoft Entra admin center.

  2. From the main page, choose Applications > Enterprise applications > All applications.

  3. Select New application and click Create your own application.

  4. Enter the application name.

  5. Enable Integrate any other application you don't find in the gallery (Non-gallery).

  6. Click Create.

  7. Enter the display name and select Supported account types.

  8. Click Register.

The new application appears in Home > Enterprise applications > All applications.

What to do next

To configure the new application further, open it from Home > Enterprise applications > All applications. For further details, see Configure Azure SSO for Cyber Vision Center.

Configure Azure SSO for Cyber Vision Center

Set up Azure SSO integration so Cyber Vision Center users can authenticate using their Azure Active Directory credentials.

Use this procedure to integrate Cyber Vision Center with Azure SSO. This enables centralized authentication and simplifies role assignments managed via Azure groups.

Before you begin

  • Create the Cyber Vision Center service provider application in Azure. See Add an enterprise application in Azure.

  • Prepare your Azure tenant for integration.

  • Ensure the Cyber Vision Center hostname is a resolvable DNS entry.

  • Verify that usernames and NameID attributes are valid email addresses.

  • You can provide multiple groups. Assign roles to users based on priority.

Note

If Cyber Vision Center offers multiple accessible URLs, SSO users must always use the configured login URL.

Procedure

  1. Sign in to the Microsoft Entra admin center.

  2. From the main menu, choose Applications > Enterprise applications > All applications.

  3. Select the created application.

  4. Click Single sign-on and select SAML.

  5. In Basic SAML Configuration:

    • For Identifier (Entity ID), use: Append /saml/metadata to the Cyber Vision Center login URL.

      Format: https://{Hostname}/saml/metadata

    • For Reply URL (Assertion Consumer Service URL), use: Append /saml/acs to the login URL.

      Format: https://{Hostname}/saml/acs

  6. In Attributes & Claims:

    1. Click Add a group claim.

    2. Select All groups to show the groups associated with the user in the Group Claims panel.

    3. Select Group ID as a Source attribute.

    4. Select Customize the name of the group claim under Advanced options.

    5. Enter Name (required) and save.

  7. Assign existing Azure users and groups to the Cyber Vision Center service application.

  8. Record these details from SAML-Based Sign-On for later use:

    • Login URL

    • Microsoft Entra Identifier

    • Certificate (Base64) file (download it)

    • Federation Metadata XML (download it)

    • Object ID (Group ID)

When Cyber Vision Center is ready to support Azure SSO, you can sign in using your Azure Active Directory credentials.

What to do next

To complete Azure SSO integration, configure Cyber Vision Center. For more information, see Configure Cyber Vision Center for Azure SSO.

Configure Cyber Vision Center for Azure SSO

Enable Azure Single Sign-On (SSO) authentication for users accessing Cyber Vision Center.

Before you begin

Procedure

  1. From the main menu, choose Admin > External Authentication > Single Sign-On .

  2. Click New Settings .

  3. Add Role Attribute and Email Attribute (Optional).

    For Role Attribute , enter Name (Required) used for the group claim.

  4. Configure Azure SSO credentials using one of these methods:

    1. Upload the Federation Metadata XML file under the Upload XML file field.

    2. For Manual Configuration :

      • Enter the Login URL in the Identity Provider Single Sign-On (SSO) URL field.

      • Enter the Microsoft Entra Identifier in the Identity Provider (Idp) Issuer URL field.

      • Add the Certificate (Base64) in the X509 field.

  5. Click Role Mapping .

  6. Enter the Object ID (Group ID) in the Default roles or Customer roles field.

  7. Click OK .

The Login with SSO button appears on the Cyber Vision Center login screen.

What to do next

Click Login with SSO to access the Cyber Vision Center using Azure SSO authentication.

Duo Single Sign-On solutions

A Duo single sign-on (SSO) is a cloud-hosted identity provider that:

  • facilitates inline user enrollment,

  • offers self-service device management, and

  • supports various authentication methods, including passkeys and security keys, Duo Push, or Verified Duo Push in the Universal Prompt.

Duo Single Sign-On overview and policy control

You add two-factor authentication and flexible security policies to any SAML application with Duo Single Sign-On .

Cyber Vision Center uses Duo's strong authentication and flexible policy engine in the applications that comply with Security Assertion Markup Language (SAML) 2.0 or OpenID Connect (OIDC) authentication standards. Duo Single Sign-On serves as an identity provider (IdP). It authenticates users through existing on-premises Active Directory or any SAML 2.0 identity provider, and requires two-factor authentication before granting access to the service provider's application.

Duo Single Sign-On offers various plans for different needs:

  • Duo Premier: Includes advanced features and support.

  • Duo Advantage: Builds on the Basic plan with additional features.

  • Duo Essentials: Provides essential security features.

Administrators can define application policies based on their plan. For example, some applications may enforce two-factor authentication at each login, while others limit login to once every seven days. Duo evaluates the user, device, and network against the application policy to determine access.

Requirement: Prerequisites for Duo Single Sign-On setup

Obtain Duo Admin access with one of the following roles: Owner, Administrator, or Application Manager.

Configure a primary authentication source by setting up either an Active Directory connection or a SAML 2.0 identity provider.

  • Complete all authentication source setup steps for Duo Single Sign-On (SSO) separately from any directory sync setup.

  • Provide a SAML 2.0 service provider or OIDC relying party web application to protect with Duo SSO.

Active Directory requirements

If you use Active Directory as your authentication source, ensure the following infrastructure requirements are met:

  • Provide at least one standalone server (Windows or Linux) that can communicate with your Active Directory domain controllers.

  • Supply service account credentials for Active Directory.

  • Ensure access to DNS for the user email domains associated with SSO so you can add TXT records as required.

Verify the fully qualified domain name (FQDN) of the Cyber Vision Center is reachable.

Configure Cyber Vision Center application in Duo

Integrate the Cyber Vision Center application with Duo for user authentication using SAML Single Sign-On.

Before you begin

Procedure

  1. Log in to the Duo Admin Panel .

  2. From the main menu, choose Applications > Application Catalog .

  3. Locate the Generic SAML Service Provider labeled "SSO" and click + Add .

    Use the Documentation link to review integration requirements and steps before adding the new application.

  4. Enter Application name .

  5. Select User access option.

    Note

    Users cannot access new applications until user access is granted.

  6. Enter these details under Service Provider :

    • Entity ID :

      • Use the "/saml/metadata" with the Cyber Vision Center login URL.

      • Format: https://{Hostname}/saml/metadata

    • Assertion Consumer Service (ACS) URL :

      • Use the path "/saml/acs" with the login URL.

      • Format: https://{Hostname}/saml/acs

    The Metadata section presents SAML identity provider details for Duo Single Sign-On in the table.

    Name

    Description
    Entity ID

    The global, unique name for Duo Single Sign-On. Sometimes referred to as "Issuer."
    Single Sign-On URL

    The authentication URL for Duo Single Sign-On. This is sometimes referred to as "SSO URL" or "Login URL". The URL is used to start IdP-initiated authentications.
    Single Log-Out URL

    This optional field specifies the logout URL for Duo Single Sign-On, sometimes referred to as the “SLO URL” or “Logout Endpoint. This field is optional.
    Metadata URL

    This URL can be used by service providers to download the XML metadata from Duo Single Sign-On.
    SHA - 1 Fingerprint

    The SHA-1 fingerprint of the SAML certificate. Sometimes service providers will request a fingerprint instead of uploading a SAML certificate.
    SHA - 256 Fingerprint

    The SHA-256 fingerprint of the SAML certificate. Service providers may request a fingerprint instead of a SAML certificate.
    Certificate

    The certificate used by the service providers to validate the signature on the SAML response sent by Duo Single Sign-On. Click Copy certificate .
    SAML Metadata

    Service providers use the XML SAML Metadata from Duo Single Sign-On to configure settings. Click the Download XML to download the xml file.

  7. In Map attributes :

    1. Select Email Address in the IdP Attribute field.

    2. Enter an attribute name in the SAML Response Attribute field (for example, "email").

      Note

      Configuring the Email attribute is optional.

  8. In Role attribute :

    1. Add an Attribute name , for example "GroupName".

    2. Map Service Provider's Role with Duo groups .

  9. Click Save .

The Cyber Vision Center application is integrated with Duo and ready to use SAML for authentication.

What to do next

Configure the Cisco Cyber Vision Center for Duo. See Configure Cisco Cyber Vision Center for Duo .

Configure Cisco Cyber Vision Center for Duo

Enable SSO login on Cisco Cyber Vision Center using Duo as an identity provider.

Before you begin

Obtain these Duo SSO details from Configure Cyber Vision Center application in Duo :

  • Attribute name

  • SAML Response Attribute

  • SAML Metadata xml file

  • Single Sign-On URL

  • Entity ID

  • Certificate

  • Service Provider's Role

Follow these steps to centrally configure SSO authentication after preparing Duo configuration details.

Procedure

  1. From the main menu, choose Admin > External Authentication > Single Sign-On .

  2. Click New Settings .

  3. Enter Attribute name in the Role Attribute field.

  4. Enter SAML Response Attribute in the Email Attribute field.

    Note
    Configuring the Email attribute is optional.

  5. Complete the configuration using one of these methods:

    1. Upload the SAML Metadata XML file under the Upload XML file field.

    2. For Manual Configuration :

      • Enter the Single Sign-On URL in the Identity Provider Single Sign-On (SSO) URL field.

      • Enter the Entity ID in the Identity Provider (Idp) Issuer URL field.

      • Add the Certificate in the X509 field.

  6. Select the Role Mapping tab.

  7. Enter Service Provider's Role details in the Default roles or Custom roles field.

  8. Click OK .

After you complete the configuration, the Login with SSO button appears on the Cyber Vision Center login screen.

What to do next

Use the Login with SSO button to test SSO login via Duo.