Configure Multiple SSO Identity Provider Connections

Overview

Cloud Control Center (CCC) can connect to up to 10 OpenID Connect (OIDC) identity providers for Single Sign On (SSO). Each SSO provider has its own name, credentials, redirect URL and role mappings, so users from different organizations or directories can sign in to the same CCC tenant with their own work accounts. On the login page, each user selects the provider for their organization.

Each identity provider needs an OIDC application registration for Cloud Control Center before you add it. For the identity provider steps, see Set Up Microsoft Entra ID (Azure AD) Single Sign On (SSO), Set Up Okta Single Sign On (SSO), Set Up Ping Identity Single Sign On (SSO) or Set Up SecureAuth Single Sign On (SSO).

How It Works

SSO Providers and Redirect URLs

SSO providers are managed on the SSO Configuration tab of Settings > Administration. The SSO Configuration List shows each provider with its Name, Last Modified date and Modified By user, and the number of configured providers appears next to the list title. A tenant can have up to 10 SSO providers. When 10 providers exist, the Add SSO Provider button is unavailable and displays the tooltip "Up to 10 SSO Providers can be added".

Cloud Control Center assigns each provider a unique Redirect URL when the provider is saved. The Redirect URL is where the identity provider returns users after they authenticate, so it must be registered in that provider's application registration before its users can sign in.

The Actions menu on each row provides View, Edit, Role Configuration, View Redirect URL and Delete, described in the sections below.

Role Mappings

Role mappings are configured per provider. Each mapping pairs a Key and Value from the identity provider's token with a Cloud Control Center user role. Each time a user signs in with SSO, Cloud Control Center replaces the user's roles with the roles matched by the mappings of the provider the user signed in through. Roles assigned to an SSO user manually in Cloud Control Center are replaced at the user's next SSO login. A user who matches no mapping can sign in but has no permissions.

The Login Page

The CCC login page shows SSO options based on the number of configured providers:

• No providers: No SSO option is shown.
• One provider: A single Log In With SSO button is shown.
• Two or more providers: Log In With SSO opens a list of providers by name. Users select their organization's provider.

Because users choose from this list, name each provider after the organization or directory its users recognize.

One Identity Provider per User

Adding an SSO Provider

Step 1. Navigate to Settings > Administration and select the SSO Configuration tab.

Step 2. Click Add SSO Provider.

Step 3. Provide the identity provider's metadata:

• To discover it automatically, leave Use Discovery Endpoint turned on, enter the identity provider's OIDC discovery URL in Discovery Endpoint and click Discover. When the message "Discovery endpoint is successful" appears, the Metadata fields are filled in.
• To enter it manually, turn off Use Discovery Endpoint and complete the Token Endpoint, Authorization Endpoint, JSON Web Key Set, User Information Endpoint and Issuer fields under Metadata.

Step 4. In Name, enter the name users see on the login page (up to 60 characters).

Step 5. Enter the Client ID and Client Secret from the identity provider's application registration, and the Scopes the provider requires, such as openid, email and profile.

Step 6. Click Add. The Connection created dialog displays the provider's Redirect URL. Click Copy, and then click Done.

Step 7. In the identity provider's application registration, add the copied Redirect URL as an allowed redirect URL. Users cannot sign in through this provider until the Redirect URL is registered.

The provider appears in the SSO Configuration List and on the login page. Next, configure its role mappings.

Configuring Role Mappings for an SSO Provider

Step 1. In the SSO Configuration List, open the Actions menu for the provider and select Role Configuration. You can also click Role Configuration on the provider's details page.

Step 2. Click Add Role and complete the new row:

• Key: The claim name in the identity provider's token, for example roles or groups.
• Value: The group or role value in that claim, for example TenantAdmin.
• User Role: The Cloud Control Center role to assign, such as Tenant Admin, Tenant User or a custom role. For more information, see Role Based Access Control (RBAC).

Key and Value are case sensitive and must match the identity provider's token exactly. Repeat this step for each mapping. To remove a mapping, click its delete icon.

Step 3. Click Save Changes. The message "Role mappers have been updated successfully." confirms the change, and the mappings appear in the Configured Roles grid on the provider's details page.

Managing SSO Providers

Viewing Provider Details

In the SSO Configuration List, open the Actions menu for a provider and select View. The View SSO Provider page shows the provider's settings, with Edit and Delete buttons at the top.

Copying the Redirect URL

Open the Actions menu for the provider and select View Redirect URL, and then copy the URL.

Editing an SSO Provider

Open the Actions menu for the provider and select Edit, or click Edit on the provider's details page. Re-enter the Client Secret before you save, even if it has not changed. Cloud Control Center does not check the Client Secret against the identity provider when you save, so an incorrect secret causes SSO logins through that provider to fail.

Deleting an SSO Provider

Open the Actions menu for the provider and select Delete, or click Delete on the provider's details page. In the Delete the existing SSO Configuration? dialog, click Yes, Delete. Cloud Control Center removes the provider and its role mappings, and users who sign in through that provider can no longer access Cloud Control Center with SSO. Other providers are not affected. Remove the Redirect URL from the identity provider's application registration as well.

Troubleshooting

Related Articles

• Set Up Microsoft Entra ID (Azure AD) Single Sign On (SSO)
• Set Up Okta Single Sign On (SSO)
• Set Up Ping Identity Single Sign On (SSO)
• Set Up SecureAuth Single Sign On (SSO)
• Role Based Access Control (RBAC)