Enabling SSO in Talend Cloud Management Console - Cloud

Talend Cloud Management Console User Guide
Version
Cloud
Language
English
Product
Talend Cloud
Module
Talend Management Console
Content
Administration and Monitoring > Managing projects
Administration and Monitoring > Managing users
Deployment > Deploying > Executing Pipelines
Deployment > Deploying > Executing Tasks
Deployment > Scheduling > Scheduling Tasks
Last publication date
2023-09-20

Configure SSO on your Talend Cloud platform after setting up an application on your SSO provider side.

Before you begin

  • You must have the Security Administrator role in Talend Cloud Management Console.
  • You must have the metadata file obtained from the SSO provider.

Procedure

  1. Log in to Talend Cloud Management Console.
  2. Go to Users & Security > Authentication.
  3. In the External Single Sign-On provider part, click Configuration.
  4. Enter the SSO provider domain name in the Organization URL field.
  5. Upload the metadata file you downloaded from the SSO application configuration by clicking the icon.
  6. Check the default User attributes. If needed, edit them to match the application configuration specified on the SSO provider side.
    These attributes are propagated to the SAML token used to authenticate users. The application configuration on the SSO provider side must specify these attributes as well as two other attributes:
    • The TalendCloudDomainName attribute that indicates your Talend Cloud account name. You can find the account name in the Domain field of the Subscription page of your Talend Management Console.
    • The NameId Format attribute that indicates the email address format.
  7. Click Test to check your configuration.
    Note: The test checks that the provided URL and metadata file are valid. It does not guarantee that logging in through this SSO configuration will work.
  8. Optional: Toggle the Just-in-time user provisioning option ON to automatically create users in Talend Cloud Management Console when logging in to a Talend Cloud application via the identity provider.
    Select the default roles to be assigned to every automatically created user. These users use the following format for their names in the Login name field: username.DomainName@TalendCloudDomainName, for example,

    ychen.company.com@support.talend.com.

    Note: Make sure that the selected set of default roles poses no security risk for your platform.
  9. Optional: Customize the logout URL. For example, redirect users to a specific page. By default, users are redirected to the Talend Cloud login page when they log out.
    For more information on the format to use for this URL, see the documentation of your SSO provider.
  10. Click Save and Activate.

Results

You can now assign users to the application on the SSO provider side. They are then able to log in to Talend Cloud through SSO.

Note: Unless the Just-in-time user provisioning option is enabled, you must add users manually on the SSO provider side. If these users already existed in Talend Cloud, make sure that the email address used is the same.

After single sign-on is enabled, you must generate an Access Token in Talend Cloud and use this token inside Studio. For further information about how to generate a token in Talend Cloud, see Generating a Personal Access Token.

Only users with the Security Administrator role can log in to Talend Cloud without using the identity provider.

As a Security Administrator, you can disable the active SSO configuration at any time from this Authentication page by toggling the External single sign-on provider option off. As a consequence, users can only login using their Talend Cloud username and password. The previous configuration is still saved if you want to enable it again.

What to do next

When the SSO certificate is renewed on your SSO provider side, you must update this certificate on your Talend Cloud platform.

To do this, download the metadata file from your SSO provider again and upload it to Talend Cloud Management Console by following the same procedure described above.