Single Sign-On (SSO) is a mechanism that allows users to access multiple resources using a single action of authentication and authorization. Druva supports SSO for administrators. By enabling SSO, administrators can access all Druva services without needing a separate login. An SSO login validates usernames and passwords against your corporate user database, typically managed by your Identity Provider (IdP). A successful validation ensures that users and administrators can log on to the Druva Cloud Platform Console without needing a Druva-generated password.

❗ Important

Druva supports SSO by implementing federated authentication using Security Assertion Markup Language (SAML) version 2.0. Federated authentication allows Druva to skip the validation of passwords.

To enable SSO, an administrator must first work with an Identity Provider (IdP) to create a corporate database that includes all Druva administrators. If you already have an IdP, you can configure Druva to work with this IdP. The IdP maintains a record of all usernames and their subsequent passwords in an encrypted format.

If you created a corporate database with an IdP for the first time, administrators logging on for the first time are redirected to an IdP login details page that prompts the user for a one-time provision of passwords. The IdP redirects the user to the Druva Cloud Platform Console. The administrators can now access the Druva Cloud Platform Console without individual passwords.

However, if you use a preconfigured IdP or if this is a subsequent login, Druva uses SAML assertions in an HTTP POST profile to communicate with your IdP. For every login attempt, Druva sends SAML requests to the IdP login URL specified under Druva Cloud Settings > Access Settings > Single Sign-On > Edit . The IdP validates the SAML query, sets the assertion in HTTP POST to True, and sends this response to Druva. Druva receives the assertion, which indicates that the administrator is validated and allowed access to the Druva Cloud Platform Console.

However, if the IdP does not find a match within its database, it sets the assertion in HTTP POST to False, thus indicating that the administrator is not authorized to access the Druva Cloud Platform Console. Upon receiving this response, Druva denies access to the Druva Cloud Platform Console.

Druva integrates with the majority of the SAML IdPs. This section provides information on the SAML IdPs that Druva certifies and supports.

Druva categorizes its IdP support levels as follows:

All IdPs that support SAML 2.0.

📝 Note
​ Contact Support for assistance in configuring an IdP that is not listed under Certified IdPs .

This table describes the chronology that you should follow to enable SSO for administrator and user access.

To enable SSO for users and administrators in your organization, you must work with your Identity Provider (IdP) to create a corporate database that contains the usernames and passwords of Druva administrators. If your organization uses an IdP, you can configure Druva to recognize this IdP. The IdP maintains a credentials record and validates a username against its password for each login attempt. Druva supports leading IdPs such as Okta, PingIdentity, OneLogin, and Active Directory Federation Services (ADFS).

To configure Druva for SSO, you must obtain the following information from your IdP.

From the list of various IdPs, you can choose the preferred IdP that is supported in your organization and then configure the IdP to enable SSO for the Druva Cloud Platform.

Based on the IdP that you prefer, the following topics will guide you in configuring the IdP for SSO.

If you are a Druva Cloud Administrator, you can configure SSO for your Druva account. At the time of configuration, you must provide IdP details that you obtained at the time of working with your IdP.

To configure Single Sign-On settings:

To allow your IdP to recognize requests that inSync and Enterprise Workloads send, you must first generate an SSO token and then update your IdP configuration with this token. The SSO token uniquely identifies Druva login requests. For login attempts, Druva sends a request to the IdP (typically using HTTP POST). In its response, the IdP attaches this token, thereby indicating the veracity of authentication requests. When Druva receives this response, it uses the SSO token ID to validate the authenticity of the IdP response.

📝 Note
​ You can generate the token multiple times, but until you update the newly generated token in IdP, the previously generated token will be used to authenticate sign-in requests.

If you have completed the configuration in the previous steps, do the following steps to generate an SSO token:

To allow your IdP to recognize requests that Druva sends, update your IdP configuration with the token you generated in the Generate SSO token section. The SSO token uniquely identifies Druva login requests. For login attempts, Druva sends a request to the IdP (typically using HTTP POST). In its response, the IdP attaches this token, thereby indicating the veracity of authentication requests. When Druva receives this response, it uses the SSO token ID to validate the authenticity of the IdP response.

Before updating IdP details, ensure that:

💡 Tip

Unless otherwise noted, use the following procedure as a guide. Use the documentation provided by your IdP for the correct configuration procedure.

The Single Sign-On is set up after all the steps are completed successfully, and administrators can log in to the Druva Cloud Platform Console by using SSO in your organization.

After SSO is enabled, Druva disables passwords for all product administrators, except the Druva Cloud Administrators and the administrators having the Legal Admin role. Once SSO is enabled, failsafe login is enabled for Druva Cloud Administrators and the administrators having the Legal Admin role.

What should you know about enabling SSO and failsafe:

To enable Single Sign-On for administrators:

You can enable SSO for inSync end users from the profiles section on the inSync Management Console. For more information, see Enable SSO for inSync users.

After you disable SSO, Druva enables passwords for all other administrators. To disable Single Sign-On for administrators:

📝 Note
​ Failesafe for administrators is mandatory if you have configured your IdP with a custom entity ID and cannot be disabled.

After you set up SSO, as a result: