- \n
- A 探花大神 administrator account<\/li>\n\n\n\n
- 探花大神 SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- A Splashtop account with the Owner role<\/li>\n\n\n\n
- A Splashtop Enterprise Plan<\/li>\n<\/ul>\n\n\n\n
Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- SSO is required for Identity Management. Contact Splashtop to subscribe to the SSO feature.<\/li>\n\n\n\n
- If you need to update your token, you must deactivate the IdM integration<\/a>, update the token, and then reactivate the IdM integration.<\/li>\n\n\n\n
- Users who are suspended or have been removed from all user groups associated with the Splashtop integration in 探花大神 will still show as \u2018active\u2019 in Splashtop. These users will no longer be synced though.<\/li>\n\n\n\n
- Deleting a user who is part of one or more groups associated with Splashtop in 探花大神 will also delete the user in Splashtop.<\/li>\n\n\n\n
- We recommend adding a user to only one Splashtop managed group in 探花大神, because a user can’t be a member of multiple synced groups in Splashtop. If a user is a member of more than one group managed by 探花大神, the user will only be added to the most recently created 探花大神 managed group. If the most recently created 探花大神 managed group is deleted, the user will be moved to the second most recently created 探花大神 managed group of which the user is a member, and so on. If all 探花大神 managed groups of which a user is a member are deleted, the user will be added to the default group in Splashtop and remain active, but will no longer be managed by 探花大神.<\/li>\n\n\n\n
- Users cannot be filtered by email.<\/li>\n\n\n\n
- The HTTP PATCH <\/kbd>method is not supported.<\/li>\n\n\n\n
- The HTTP DELETE <\/kbd>method works as a “hard delete” and wipes the user from the account.The same happens with groups<\/li>\n\n\n\n
- The HTTP PUT <\/kbd>method doesn’t support the update of the “activate”<\/kbd> user attribute, therefore when the user is deactivated <\/kbd>in 探花大神 it will still appear as activate <\/kbd>in the Splashtop account but the user won’t be updated or managed from 探花大神 unless it’s reactivated<\/kbd> by the admin.<\/li>\n<\/ul>\n\n\n\n
Attribute Considerations<\/strong><\/p>\n\n\n\n
A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details.<\/p>\n\n\n\n
- \n
- You must add a constant attribute ssoName<\/strong> to the SSO configuration in 探花大神. The value must match the SSO Name value set in Splashtop. This value will be passed as a user attribute. Users and groups can’t be provisioned without this value.<\/li>\n<\/ul>\n\n\n\n
Creating a new 探花大神 Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the 探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure 探花大神<\/strong> <\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- The default values set in the SSO<\/strong> tab contain all the necessary configuration details.<\/li>\n\n\n\n
- IDP URL<\/strong> can be customized or kept as the default.<\/li>\n\n\n\n
- If you want to do a service-provider initiated SSO flow, enter jumpcloud-login<\/strong> in the Default RelayState field.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Download the 探花大神 metadata<\/strong> file<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- The 探花大神-<applicationname>-metadata.xml<\/strong> will be exported to your local Downloads <\/strong>folder.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nMetadata can also be downloaded from the Configured Applications<\/strong> list. Search for and select the application in the list and then click Export Metadata<\/strong> in the top right corner of the window.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure Splashtop<\/strong><\/h3>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nFor more information on configuring 探花大神 for SSO with Splashtop see Splashtop\u2019s SSO setup – 探花大神 (SAML 2.0)<\/a> documentation. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Log in to the Splashtop portal<\/a>.<\/li>\n\n\n\n
- From the top navigation bar, select Management<\/strong> > Settings.<\/strong><\/li>\n\n\n\n
- From the left navigation bar of the Settings<\/strong> page, select Team<\/strong>.<\/li>\n\n\n\n
- Scroll down to the Single Sign On<\/strong> section.<\/li>\n\n\n\n
- Click Apply for new SSO method<\/strong>. Learn more about this in Splashtop’s How to Apply for a New SSO Method<\/a> documentation.<\/li>\n\n\n\n
- Enter an SSO Name<\/strong>.<\/li>\n\n\n\n
- Select 探花大神<\/strong> for IDP Type<\/strong>.<\/li>\n\n\n\n
- Leave SAML 2.0<\/strong> as the Protocol<\/strong>.<\/li>\n\n\n\n
- Use the metadata import option at the bottom of the form to automatically populate the IDP SSO Login URL<\/strong>, IDP Issuer<\/strong>, and X.509 Certificate<\/strong> values.\n
- \n
- Select Upload an XML file<\/strong>.<\/li>\n\n\n\n
- Click Choose an XML file<\/strong>.<\/li>\n\n\n\n
- Upload the metadata file you downloaded from the 探花大神 administrator portal.<\/li>\n\n\n\n
- Click Import<\/strong>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Clear the certificate information from the X.509 Certificate<\/strong> field. You will need to replace the certificate value, because it must be enclosed in —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–.<\/li>\n\n\n\n
- Open the certificate.pem file you downloaded from the 探花大神 admin portal and copy all the file contents<\/li>\n\n\n\n
- Paste the contents from the certificate file in X.509 Certificate<\/strong> field.<\/li>\n\n\n\n
- Enter your whitelisted domain(s), which are the domains for the users you want to provision within Splashtop.<\/li>\n\n\n\n
- Click Save<\/strong>.<\/li>\n\n\n\n
- The Splashtop validation team will verify the SSO method information you entered. It may take 1-2 business days to complete the validation. The SSO method will remain in a pending status until the validation is complete.<\/li>\n\n\n\n
- You will receive an email to verify your domain(s). Follow the instructions in the email to complete the process.<\/li>\n\n\n\n
- Once your SSO method is validated and domain(s) verified, your SSO configuration is complete.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to 探花大神, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO user authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Access the 探花大神 User Console<\/a><\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- 探花大神 asserts the user’s identity to the SP and is authenticated without the user having to log in to the application<\/li>\n<\/ul>\n\n\n\n
SP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Go\u00a0to the SP application login – generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
This varies by SP.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Login redirects the user to 探花大神 where the user enters their 探花大神 credentials<\/li>\n\n\n\n
- After the user is logged in successfully, they are redirected\u00a0back to the SP and automatically logged in<\/li>\n<\/ul>\n\n\n\n
Configuring the Identity Management Integration<\/strong><\/h2>\n\n\n\n
To configure SplashTop<\/strong><\/h3>\n\n\n\n
- \n
- Log into Splashtop portal<\/a>.<\/li>\n\n\n\n
- Go to Management<\/strong> > Settings<\/strong> > Teams<\/strong> tab.<\/li>\n\n\n\n
- Scroll down to the SCIM Provisioning Token<\/strong> section. <\/li>\n\n\n\n
- Click the Set up an API token<\/strong> link.<\/li>\n\n\n\n
- Click Generate<\/strong>.<\/li>\n\n\n\n
- Copy the generated token.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Warning:<\/strong> \nThe Client ID and Secret (token) may only be shown once. Copy them to a secure location, like the 探花大神 Password Manager<\/a>, for future reference.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure 探花大神<\/strong><\/h3>\n\n\n\n
- Go to Management<\/strong> > Settings<\/strong> > Teams<\/strong> tab.<\/li>\n\n\n\n
- Log into Splashtop portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Click Choose an XML file<\/strong>.<\/li>\n\n\n\n
- From the top navigation bar, select Management<\/strong> > Settings.<\/strong><\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- The default values set in the SSO<\/strong> tab contain all the necessary configuration details.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the 探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n