Stratforge OneAuthentication & SSO
Single sign-on (SSO) lets your members sign in through an identity provider you already run, instead of managing a separate Stratforge password. You connect providers from the Identity providers section of the Security area, where each connection appears in a list you can add to, edit, enable, disable, or remove.
Stratforge One supports two kinds of identity provider:
- SAML SP - a SAML 2.0 connection to your identity provider.
- Active Directory / LDAP - a directory connection over LDAP.
Adding an identity provider
- Go to Security and find the Identity providers list.
- Select Add providers.
- Choose the provider you want to connect - SAML SP or Active Directory / LDAP - and continue.
- Fill in the configuration for that provider type (described below) and create it.
You'll see a confirmation once the provider is created, and it appears in the list.
Connecting a SAML provider
For a SAML connection you provide:
- Name - a label for the connection as it appears in your list.
- Metadata type - choose how you supply the provider's SAML metadata:
- URL - paste the Metadata URL where your identity provider publishes its metadata.
- XML - paste the metadata your identity provider gives you directly.
- Binding - the SAML binding to use: unspecified, POST, redirect, or artifact.
- Sign in request - whether Stratforge signs its authentication requests to the provider. This is on by default.
Supplying metadata by URL keeps the connection in sync automatically when your provider rotates certificates or endpoints, since Stratforge reads the published metadata. Use XML when your provider doesn't expose a metadata URL.
Connecting an LDAP / Active Directory provider
For an LDAP connection you provide the directory's connection details and tell Stratforge how to read user records:
Connection
- Name - a label for the connection.
- Servers - one or more LDAP server addresses (you can add several).
- Base name - the base DN to search from.
- Bind name and Bind password - the credentials Stratforge uses to connect to the directory.
- Userbase - the DN under which user accounts live.
- User filters and User object classes - narrow which directory entries are treated as users.
Attribute mapping
Map your directory's attributes to Stratforge user fields:
- First name attribute
- Last name attribute
- ID attribute
- Email attribute
Optional settings
Expand the optional section for additional controls when you need them: TLS (StartTLS), Timeout in seconds, and extra attribute mappings - avatar URL, display name, email verified, nickname, preferred username, and profile.
When you edit an existing LDAP provider, the bind password is left unchanged unless you tick Update bind password and enter a new one.
Enabling, disabling, and removing providers
Each provider in the list has an actions menu with three choices:
- Edit - reopen the configuration to update any field.
- Disable / Enable - turn the connection off or back on without deleting it. A disabled or active state is reflected in the list's Status column.
- Delete - remove the connection entirely. You'll be asked to confirm.
When you disable or remove an identity provider, members who used to sign in through it can no longer use that route. They fall back to your organization's other sign-in policy instead. Make sure those members have another way in before you turn a provider off.
How SSO affects member sign-in
Members sign in to Stratforge through the standard sign-in flow. Once you've connected and activated an identity provider, that provider becomes an available sign-in route for your organization, so members can authenticate with their existing credentials rather than a separate Stratforge password.
Activating a provider is the test: enable it, then sign in through it to confirm the connection works end to end. If something is misconfigured, you can disable the provider to take it out of rotation, fix the settings with Edit, and re-enable it.
Members themselves are managed in the Directory; the SSO connection governs how they prove who they are, not what they can access.