Single Sign-On

SSO setup involves the exchange of metadata between the Identity Provider and the Service Provider. This can be challenging because each side requires information from the other side before setup is complete. These instructions assume that the Virgo configuration is both the first and last step to minimize the impact on customer IT resources.

1. Log in to Virgo with administrator privileges.
2. Click on the Admin link and then click on the Identity Providers tab.
3. Create a New identity provider. Use “TBD” for the fields SSO URL, Entity ID, and IdP Certificate. See the Identity Provider Record Fields table below for additional details.
4. Download the metadata file by clicking on the Virgo SSO Metadata link.
5. Provide the metadata file to the administrator of the IdP. An Identity Provider (IdP) is the system that produces SAML assertions and authenticates users. The IdP is provided by the customer setup needs to be completed and necessary users (those who are named users in Virgo) need to be granted access in the configuration. Once completed, the IdP administrator will send the necessary metadata.
6. Once you have received the IdP metadata (certificates are sometimes provided separately for convenience), complete the setup of the identity provider record. Enter the correct values for SSO URL, Entity ID, and IdP Certificate. Verify the configuration of the remaining fields.
7. In Virgo SSO, test the SSO setup by opening a fresh web browser (or private/incognito browser window) to the Virgo SSO ACS URL.

To view an example of the Identity Providers tab, hover your mouse over the image.

The table below describes SSO and Virgo terminology.

The Virgo Employee Portal SSO setup follows the same process as Virgo SSO Configuration; however, there are some key differences:

1. Select a portal user for Employee Portal User Mapping to grant access to users without a named user in Virgo.
2. You generally will not want to show this option on the login page.
3. The IdP administrator will typically grant access to this connection for all users in the organization, not just Virgo named users.
4. For metadata and testing, be sure to use the Metadata link under the Employee Portal SSO heading.
5. To access the Employee Portal, use the ACS link along with the desired relay state. See the table below. Replace the Xs with connection specific IDs.

SSO URLs for the Virgo Employee Portal

The table below describes the fields available for identity provider records in Virgo.

Virgo does not support just-in-time user provisioning. You need to create user accounts for all named users who will access Virgo. You do NOT need to create a user account for anybody who will be using the Employee Portal anonymously.

Your configuration determines how match your Virgo user accounts with your IdP accounts. The default option is to match against the Virgo account username. Other options include Email address and Federation ID. The email address is typically the same as the username in Virgo, but it doesn’t have to be. Federation ID can be any string that is unique across the users in your account.

The table below describes the Login Policy options applicable to SSO.

To view an example of the Login Policy tab, hover your mouse over the image.

The SSO login page, using the Login URL specified above, will provide all identity providers set to be visible on the login page:

NOTE: If your IdP is ADFS, make sure that your identity provider configuration in Virgo has set the Authentication Context field to Disabled. Other values may still result in a successful login, but you may be prompted to re-enter your credentials even if you have already authenticated against Active Directory.