Single sign-on (SSO) is an identification method that allows users to log into multiple applications with one set of credentials. 

SCIM (System for Cross-domain Identity Management) is an industry-standard protocol that allows your identity provider (IdP) to automatically create, update, and deactivate user accounts in Titan Cloud Software. With SCIM enabled, you no longer need to manually manage store-level employees in the Titan Maintenance (Urgent) UI—your IdP becomes the single source of truth.

SAML (Security Assertion Markup Language): Traditional SSO protocol supported by Titan Maintenance (Urgent). Specification: https://datatracker.ietf.org/doc/html/rfc7522 

The authentication flow begins with the federation gateway presenting the available authentication methods to the user. Following a common SaaS pattern, the user first provides a unique identifier, typically a username or email address, which is used to determine their tenant and the identity providers (IdPs) configured for it. Each tenant is guaranteed to have local authentication enabled.

Once the available authentication methods have been presented, the user selects their preferred option, and the federation gateway processes the request accordingly.

The diagrams below illustrate the flows for the two supported authentication methods, password and SSO. For simplicity, the Service Provider and External IdP components are omitted.

 

After successful authentication by an external IdP, the federation gateway must map the returned IdP token to a corresponding Urgent user. The IdP configuration specifies the attribute that contains the Urgent username, and the final step in the flow is to locate an Urgent user whose username matches that attribute value.

The updated SSO authentication flow below includes this user-matching step.

 

For SAML the authentication can be initiated by either the IdP or SP. 

IdP initiated authentication is the simplest form, from the IdP side an assertion (token) is sent to Assertion Consumer Service (ACS) URL of the federation gateway. 

The gateway then sign-ins the user and redirects the user to the appropriate Urgent app (for SAML, this will seldom be anything other than the main web app).

 

The other initiation method is for the SP to initiate the authentication flow. This simply redirects the user to the login URL that was configured for the IdP. 

 

OIDC supports only Service Provider–initiated authentication flows. Typically, after receiving an ID token, the client must query the IdP’s User Info endpoint to obtain the user’s details. 

 

The federation gateway is designed exclusively for internal use, meaning only Urgent applications are expected to utilise it for user authentication. While the gateway can interact with non-OIDC identity providers, it enforces OIDC as the sole protocol for its clients.

1. Metadata URL – This can be found within your IdP's administration portal. 
2. Entity ID – This is usually available on your IdP's SAML configuration page.
   1. Alternatively, the Entry ID is typically listed in the metadata when the Metadata URL is opened in a web browser. 
3. Username Attribute – This is used to map users from the IdP to users in Titan Maintenance. During authentication, the IdP sends user information as attributes, and we need to know which attribute contains the Urgent username.
   1. By default, this is set to the industry-standard value: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
   2. This can be changed if needed, but in most cases, the default value is used. 

Any Titan Maintenance user added to the SamlConfiguration (Create) Role Group can configure SSO in Titan Maintenance.

 Please reach out to Support if you need assistance granting this access.

This is customizable by tenant. If “Local Login” is enabled in the SAML Configuration, users can log in with a username and password. If it is disabled, users may only log in with SSO.