Set Up SSO in a Dedicated Environment

Configure delegated DataGalaxy authentication through your corporate directory, also called an Identity Provider (IdP), from your client space administration.

Before you begin, choose the procedure for your instance in Choose Where to Start with SSO.

Configure SAMLv2

1. Initialize a SAML DataGalaxy application on your IdP (corporate directory) using the following information:
   • EntityID: https://$INSTANCE$.datagalaxy.com/Saml2

   • ACS URL: https://$INSTANCE$.datagalaxy.com/auth/realms/$REALM_ID$/broker/saml/endpoint

   • Logout URL: https://$INSTANCE$.datagalaxy.com/auth/realms/$REALM_ID$/broker/saml/endpoint

2. Replace the variables with the following values:
   • $INSTANCE$: the value of your instance, found in your access URL before .datagalaxy.com.

   • $REALM_ID$: the GUID found in your DataGalaxy login page URL after /Realm/.

3. Configure three specific claims in the DataGalaxy enterprise application you created in your directory, using these values.

   IdP attribute	Type of value	Claim value expected by DataGalaxy
   Email	URI	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   FirstName	URI	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
   LastName	URI	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

4. Retrieve the SAMLv2 configuration metadata XML file and enter it in the configuration modal, in the field Identity Provider Federation Metadata XML.
   Screenshots: where to find the REALM_ID in the login page URL, and the metadata XML field. (Re-add these images here — the original Freshdesk links expire after a few days.)

   ⚠️

   The first-connection mode initiated by the IdP (IdP-Initiated First) is not supported.

To follow the next steps of this configuration, see SSO Self Service.

Configure OIDC

1. Initialize an OIDC DataGalaxy application on your IdP (corporate directory) using the following information:
   • Redirect URI: https://$INSTANCE$.datagalaxy.com/auth/realms/$REALM_ID$/broker/oidc/endpoint

2. Replace the variables with the following values:
   • $INSTANCE$: the value of your instance, found in your access URL before .datagalaxy.com.

   • $REALM_ID$: the GUID found in your DataGalaxy login page URL after /Realm/.

3. Configure three specific claims in the DataGalaxy enterprise application you created in your directory, using these values.

   IdP attribute	Type of value	Claim value expected by DataGalaxy
   Email	URI	email
   FirstName	URI	given_name
   LastName	URI	family_name

4. Enable the desired users on this new enterprise application.

5. Retrieve the following information and enter it in the configuration modal:
   • ClientID

   • ClientSecret

   • DiscoveryUrl

   Screenshot: the OIDC configuration modal. (Re-add this image here — the original Freshdesk link expires after a few days.)

   📝

   Use email as the value for login claim type; this setting is optional.

To follow the next steps of this configuration, see SSO Self Service.

Handle a shared instance

If your access URL looks like https://$CLIENT_SPACE$.$INSTANCE$.datagalaxy.com, your client space is hosted on a multi-tenant (shared) instance. For example: https://client.app.datagalaxy.com. Here, $INSTANCE$ is app and $CLIENT_SPACE$ is client.

Use your client space name only in the EntityID: https://$CLIENT_SPACE$.app.datagalaxy.com/Saml2. The ACS and Logout URLs already include $REALM_ID$, which is enough to identify your client space.

Configure auto-provisioning

DataGalaxy supports two auto-provisioning modes.

Use JIT auto-provisioning

JIT (Just In Time) is managed by DataGalaxy and can be activated upon your request.

• Add any new user authorized to connect through their IdP but not yet known to the platform as a Reader with a license automatically assigned.

• When the user is revoked from the company directory, prevent them from logging in to DataGalaxy, but note that they remain visible on the platform until manually deleted.

Use SCIM synchronization

• Synchronize the authorized user group(s) with DataGalaxy users regularly.

• Add all users authorized in the directory on the first synchronization, then synchronize subsequent changes regularly.

• Complete this configuration on your side with the following attributes:
  • SCIM API URL for your DataGalaxy space: https://$INSTANCE$.api.datagalaxy.com/v2/scim, where $INSTANCE$ is the value of your instance found in your access URL before .datagalaxy.com.

  • Secret token: the integration token value, which you must generate in your DataGalaxy admin space with admin privileges (see Generate Tokens to Communicate with the API).

Read more

• Choose Where to Start with SSO

• SSO Self Service