Configure Single Sign-On (SSO) via SAML

Single sign-on (SSO) lets customers and Admin Portal users log in with their corporate identity provider credentials instead of a separate Gcore username and password. Gcore implements SSO through SAML 2.0 (Security Assertion Markup Language), an open XML standard for exchanging authentication data between a corporate identity provider (IdP) and Gcore as the service provider (SP).

Configure SSO in the Admin Portal

Connecting an identity provider requires enabling SSO login, then filling in the provider’s connection details.

1. Enable SSO login

   1. Navigate to the Security settings.
   2. Click Authorization.
   3. Enable the SSO login toggle.
2. Configure the provider

   In the Provider section that appears:

   1. In the Name field, enter any identifier for the identity provider; this value only appears in the Admin Portal and doesn’t affect the SSO connection.
   2. In the Entity ID field, enter the globally unique identifier for the identity provider, provided by the IdP.
   3. In the Domains field, enter the corporate domains that redirect to the identity provider for SSO authorization.
   4. Under SAML metadata, click Attach file and upload the identity provider’s metadata XML file, provided by the IdP.
   5. Select For the customer portal, For the admin portal, or both, depending on which accounts can use SSO.
   6. Click Save.

   

Enabling Force redirect to the Identity provider skips the corporate domain entry step during sign-in and redirects users straight to the identity provider, but this only works when the Base customer portal domain field is filled in on the Branding settings page.

Add Gcore metadata to the identity provider

Configuring the Admin Portal side is only half the connection, since the identity provider also needs the Gcore side’s metadata. All the necessary metadata is available at https://api.gcore.com/iam/auth/saml2/metadata. Identity providers using a self-signed SSL certificate need this option enabled in their own settings.

Sign in with SSO

Once SSO is configured, a Sign in with SAML SSO link appears on the sign-in page for both the Customer Portal and the Admin Portal.

Clicking the link prompts for the corporate domain, unless Force redirect to the Identity provider is enabled, in which case this step is skipped.

After entering the domain, the identity provider handles authentication and returns the user signed in.

Support IdP-initiated login

Gcore’s SAML implementation primarily supports service provider (SP)-initiated login, but identity provider (IdP)-initiated login also works with the right configuration:

1. Configure the identity provider to redirect login requests to the Gcore service provider endpoint auth.gcore.com, or the reseller’s custom domain if one is set, like auth.example.com.
2. Verify SSO login is active with a provider configured, as covered above, and enable Force redirect to the Identity provider for automatic redirection.
3. Configure the identity provider to require SP-initiated login, so a user starting from the IdP is redirected to the Gcore sign-in URL first.
4. Confirm the flow end to end: a. The user starts at the identity provider. b. The identity provider redirects the request to auth.gcore.com or the custom domain. c. The user is redirected back to the identity provider for authentication. d. After successful authentication, the user lands in the Customer Portal with the correct domain settings applied.