Log in to API7 Dashboard with SSO

Single Sign-On (SSO) allows users to log in once and access multiple systems without re-entering credentials. It improves efficiency, enhances user experience, and strengthens security by eliminating the need for multiple passwords.

In API7 Enterprise, you can use multiple login options simultaneously. It is possible to create users within API7 while also importing them from other existing systems.

Architecture

Take LDAP as an example:

1. User Login Request: Users enter their username and password when logging into API7 Enterprise.
2. LDAP Verification: API7 Enterprise transfers the credentials provided by the user to the LDAP server for verification.
3. Authentication: The LDAP server verifies whether the user's credentials match the user information stored in the LDAP directory.
4. Authorization: If verification is successful, the LDAP server returns authorization information to API7 Enterprise, and the system authorizes the user to access corresponding resources based on this information.
5. Accessing Resources: Users access API7 Enterprise with the verified identity without having to re-enter credentials.

Prerequisites

1. Obtain a user account with Super Admin role.

Integrate with SSO

API7 Enterprise supports Single Sign-On (SSO) with following implementations. Integrating API7 Enterprise with other user systems enables you to log your existing users into API7 Enterprise without signing up for a new API7 account.

LDAP

1. Select Organization from the top navigation bar, then choose Settings.
2. Click Add Login Option.
3. Fill in the Add Login Option form:
   1. Name: the unique login name, must be identical to users. For example Employee Account.
   2. Provider: choose LDAP.
   3. Host: the LDAP host domain. For example, ldap.example.com.
   4. Port: For example, 1563.
   5. Base Distinguished Name: For example, oc=users,dc=org,dc=example.
   6. Bind Distinguished Name: the LDAP Bind Distinguished Name (DN) used to perform LDAP search for the user. This LDAP Bind DN should have permissions to search for the user being authenticated. For example, cn=admin,dc=org,dc=example.
   7. Bind Password: the LDAP bind password used to authenticate with the LDAP server.
   8. Identifier: the attribute used to identify LDAP users. For example, cn.
   9. Attributes Mapping: map API7 internal fields to related LDAP attributes to seamlessly integrate and synchronize data.
4. Click Add.

OIDC

1. Select Organization from the top navigation bar, then choose Settings.
2. Click Add Login Option.
3. Fill in the Add Login Option form:
   1. Name: the unique login name, must be identical to users. For example Employee Account.
   2. Provider: choose OIDC.
   3. Issuer: the identifier of the OpenID connect provider. For example, https://accounts.example.com.
   4. Client ID: the unique identifier of your application, assigned by the OIDC provider. For example, API7.
   5. Client Secret: secret key used for authentication, assigned by the OIDC provider.
   6. Request Scope: Access tokens often possess different scopes, which limit their usage. For example, profile,email.
   7. Root URL: the URL used to access API7 for generating callback URL. For example, https://auth.example.com/oidc.
   8. SSL verify: default value is open.
4. Click Add.

SAML

1. Select Organization from the top navigation bar, then choose Settings.
2. Click Add Login Option.
3. Fill in the Add Login Option form:
   1. Name: the unique login name, must be identical to users. For example Employee Account.
   2. Provider: choose SAML.
   3. Identity Provider Metadata URL: URL used to obtain information about the Identity Provider, such as its public key, supported SAML versions, signature algorithms, etc. For example, https://idp.example.com/metadata.
   4. Service Provider Root URL: the entity that requests authentication and authorization from the Identity Provider (IdP).For example, https://sp.example.com.
   5. Entity ID: a unique identifier for the Service Provider (SP) or Identity Provider (IdP) entity. It typically serves as a globally unique identifier for the entity within the SAML federation. For example, https://sp.example.com/saml/metadata.
4. Click Add.

Login with SSO

Once you have configured the Login Options, external users will be able to directly log in to the API7 Dashboard without the need for signing up.

1. Visit the API7 Dashboard at http://localhost:7080.
2. Choose from the login option name, for example Login with Employee Account.
3. Enter your username and password.
4. Click Login.

Delete Imported Users

If you delete a user with SSO login options in Users, it only means that the user will lose all their roles. However, they can still log in to the API7 Dashboard as a new user. To completely block their access to the API7 Dashboard, you must delete them from the original system.

Assign Roles for Imported Users

All newly imported users will be assigned the Viewer role by default until the Super Admin assigns them different roles.

Delete a Login Option

danger

Deleting a login option will result in the removal of all users associated with it.

1. Select Organization from the top navigation bar, then choose Users.
2. Check if there are any users still using this login option. If yes, notify them first.
3. Select Organization from the top navigation bar, then choose Settings.
4. Click Delete of the target login option.
5. Double confirm.