|
| 1 | +--- |
| 2 | +title: How to implement a single sign-on solution to authenticate users onto the |
| 3 | + HPE GreenLake edge-to-cloud platform |
| 4 | +date: 2023-11-29T12:41:00.306Z |
| 5 | +featuredBlog: false |
| 6 | +externalLink: "" |
| 7 | +author: Prabhu Murthy - Cloud Operations |
| 8 | +authorimage: /img/Avatar1.svg |
| 9 | +thumbnailimage: /img/hpe-greenlake-sso-page.jpg |
| 10 | +disable: false |
| 11 | +tags: |
| 12 | + - hpe-greenlake-platform |
| 13 | + - sso |
| 14 | + - okta |
| 15 | + - Active Directory |
| 16 | + - hpe-greenlake |
| 17 | +--- |
| 18 | +<style> |
| 19 | +li { |
| 20 | + font-size: 27px; |
| 21 | + line-height: 33px; |
| 22 | + max-width: none; |
| 23 | +} |
| 24 | +</style> |
| 25 | + |
| 26 | + |
| 27 | +Enterprises looking to use HPE GreenLake for Private Cloud Enterprise can benefit from the use of SSO, as it has been integrated onto the HPE GreenLake edge-to-cloud platform (also known as HPE GreenLake platform), which supports single sign-on. |
| 28 | + |
| 29 | +In this blog post, I will walk you through the process of configuring Okta Active Directory (AD) to authenticate users into the HPE GreenLake for Private Cloud Enterprise application on the HPE GreenLake platform using SAML Identity Provider (IdP) for single sign-on. |
| 30 | + |
| 31 | +### Before starting |
| 32 | + |
| 33 | +Please review the [HPE GreenLake](https://support.hpe.com/hpesc/public/docDisplay?docId=a00120892en_us&page=GUID-D7192971-EF71-4304-B51E-548E7954E644.html) User Guide to understand how the SAML framework works in the context of HPE GreenLake for Private Cloud Enterprise Services for the HPE GreenLake edge-to-cloud platform. |
| 34 | + |
| 35 | +### Configure SSO/SAML applications in Okta |
| 36 | + |
| 37 | + To configure application metadata in Okta, complete the following steps: |
| 38 | + |
| 39 | +* Step 1: Create an Okta SAML application |
| 40 | +* Step 2: Configure Sign On settings |
| 41 | +* Step 3: Export the SAML 2.0 IdP metadata |
| 42 | +* Step 4: Configure the SAML connection in the HPE GreenLake platform |
| 43 | + |
| 44 | +**Step 1: Create an Okta SAML application** |
| 45 | + |
| 46 | +1. Log into the Okta administration console. |
| 47 | +2. Click **Applications > Create new app integration.** The Create a new app integration window opens. |
| 48 | +3. Select SAML 2.0 and click **Next**. |
| 49 | + |
| 50 | + |
| 51 | + |
| 52 | +Provide a name for the SAML application which gets connected to the HPE GreenLake platform: |
| 53 | + |
| 54 | + |
| 55 | + |
| 56 | +**Step 2: How to configure single sign-on settings** |
| 57 | + |
| 58 | +1. Enter the SAML information. |
| 59 | + |
| 60 | + Under General: |
| 61 | + |
| 62 | + **Single Sign on URL:** https://sso.common.cloud.hpe.com/sp/ACS.saml2 |
| 63 | + |
| 64 | + **Audience URI (SP Entity ID):** https://sso.common.cloud.hpe.com |
| 65 | + |
| 66 | + **Name ID format EmailAddress** |
| 67 | + |
| 68 | + **Application username Email** |
| 69 | + |
| 70 | + **NameID = user.email** |
| 71 | + |
| 72 | + **gl\_first\_name = user.FirstName** |
| 73 | + |
| 74 | + **gl\_last\_name = user.LastName** |
| 75 | + |
| 76 | + **hpe\_ccs\_attribute = (See Below)** |
| 77 | + |
| 78 | + See here for IdP attribute details: [](https://support.hpe.com/hpesc/public/docDisplay?docId=a00120892en_us)<https://support.hpe.com/hpesc/public/docDisplay?docId=a00120892en_us&page=GUID-D7192971-EF71-4304-B51E-548E7954E644.html> |
| 79 | + |
| 80 | + A new SAML attribute has been added “hpe\_ccs\_attribute” which tells HPE GreenLake platform and HPE GreenLake for Private Cloud Enterprise application the exact role/permissions for each user. The following describes how to format the attribute. |
| 81 | + |
| 82 | + `Format: {version}#{pcid}:{app id}:{role_name}:{ALL_SCOPES}` |
| 83 | + |
| 84 | + Note : At present HPE GreenLake for Private Cloud Enterprise application role should be excluded. |
| 85 | + |
| 86 | + |
| 87 | + |
| 88 | + |
| 89 | + |
| 90 | + |
| 91 | + |
| 92 | +The **hpe\_ccs\_attribute** always starts with version1#. You must first configure the attributes for HPE GreenLake platform and to do so, enter the Platform Customer ID (PCID) for the account (this is the identifier assigned to your HPE GreenLake platform Workspace), followed by the HPE GreenLake platform application ID. This will always be **00000000-0000-0000-0000-000000000000**. Following this, enter the role name and ALL\_SCOPES**.** |
| 93 | + |
| 94 | +Example: |
| 95 | + |
| 96 | +`version_1#7ede5c36b7b911edacf45a78eb8b07d1:00000000-0000-0000-0000-000000000000:Observer:ALL_SCOPES` |
| 97 | + |
| 98 | + |
| 99 | + |
| 100 | +2. Complete the setup. |
| 101 | + |
| 102 | + |
| 103 | + |
| 104 | +Click **Next** and select **Internal App**, then **Finish**. |
| 105 | + |
| 106 | +**Step 3:** **Export the SAML 2.0 IdP metadata** |
| 107 | + |
| 108 | +1. Click Next – Configure the single sign-on settings |
| 109 | + |
| 110 | + You will find two options are available: **View Setup Instructions** which steps you through the SAML configuration and **Identity Provider metadata**, which will produce an XML file that can be loaded into HPE GreenLake platform application. |
| 111 | + |
| 112 | + Suggestion: click **Identity Provider metadata** and save the XML data to a file. |
| 113 | + |
| 114 | +  |
| 115 | + |
| 116 | +2. Click **Next**. |
| 117 | + |
| 118 | +3. Select **Internal app**, and click **Finish**. |
| 119 | + |
| 120 | + ##### **Step 3.1 : Access to the SAML application and HPE GreenLake platform is determined by assigning only those members or group to the SAML application.** |
| 121 | + |
| 122 | + |
| 123 | + |
| 124 | + |
| 125 | + |
| 126 | +**Step 4:** **Configure the SAML connection in the HPE GreenLake platform** |
| 127 | + |
| 128 | +1. Log into HPE GreenLake platform and click **Menu** > **Manage** > **Authentication** and click **Set Up SAML Connection**. |
| 129 | + |
| 130 | + _Before you can add a new SAML configuration, you must have at least **one** user account with that **domain** already enabled in HPE GreenLake platform. Also, you must be logged into HPE GreenLake platform with an account from that domain in order to enable SSO for it._ |
| 131 | + |
| 132 | +  |
| 133 | + |
| 134 | +2. Type in the domain you want to enable SSO on: |
| 135 | + |
| 136 | +  |
| 137 | + |
| 138 | +3. Input the metadata from the step above. |
| 139 | + |
| 140 | + While HPE GreenLake platform does support entering this information manually, it's recommended that you simply upload the XML metadata that was downloaded in the previous step. To do so, select **Metadata File**, selecting the XML file. Then, click **Next**. |
| 141 | + |
| 142 | +  |
| 143 | + |
| 144 | +4. Enter the SAML attributes to match what was entered in Okta. Set the idle timeout value as well. |
| 145 | + |
| 146 | +  |
| 147 | + |
| 148 | +5. Then click **Next**. |
| 149 | + |
| 150 | +6. Create a recovery user so that, in the event SSO fails, an admin will still be able to access the HPE GreenLake platform. |
| 151 | + |
| 152 | +  |
| 153 | + |
| 154 | + Congratulations! SSO will now be enabled for HPE GreenLake platform as well as the HPE GreenLake for Private Cloud Enterprise application. Log out and on the HPE GreenLake platform home page, click **Sign in with SSO**. |
| 155 | + |
| 156 | +**Testing and troubleshooting:** |
| 157 | + |
| 158 | +On the HPE GreenLake edge-to-cloud platform home page, click **Sign In with SSO**. |
| 159 | + |
| 160 | + |
| 161 | + |
| 162 | + |
| 163 | + |
| 164 | +Enter the SSO credentials. You will be redirected to Okta to authenticate. Once you successfully authenticate, you will be redirected back to HPE GreenLake platform. You can then click on the HPE GreenLake for Private Cloud Enterprise application and be given access based on the configured role/permissions. |
| 165 | + |
| 166 | +**Additional notes:** |
| 167 | + |
| 168 | +* There must be at least **one** verified user belonging to the **Domain** prior to configuration. |
| 169 | +* In order to configure SSO, you must be logged into the HPE GreenLake edge-to-cloud platform with a user from the domain. |
| 170 | +* SSO user access is determined by the “role_name” attribute included in the SAML hpe_ccs_attribute provided by the IdP. |
| 171 | +* For more troubleshooting: <https://support.hpe.com/hpesc/public/docDisplay?docId=a00120892en_us> |
| 172 | +* Customer users should be given access to SAML application. |
| 173 | +* After authentication when clicking the HPE GreenLake for Private Cloud Enterprise application**,** if it leads to the below error, it will take 1 hr to sync. If it does not do so within that time period, the customer should contact their HPE administrator. |
| 174 | + |
| 175 | +I hope this blog post answers any questions you may have had in regards to how to configure single sign-on for HPE GreenLake for Private Cloud Enterprise on the HPE GreenLake platform using Okta Active Directory. Please return back to the [HPE Developer Community blog](https://developer.hpe.com/blog) for more tips and tricks on working with the HPE GreenLake platform. |
0 commit comments