Configure SSO Authentication in VMS

  • Updated on Jan 30, 2026
  • Published on Jan 28, 2026
  • 7 minute(s) read
Prev Next

Overview

VAST VMS supports Single Sign-On (SSO) authentication using SAML-based Identity Providers (IdP). This allows VMS managers to sign-in to aVAST Cluster using their credentials an IdP such as Okta,

This guide describes how to configure this using Okta as the IdP.

When configured for SSO with an IdP, VMS acts as the SAML Service Provider (SP),

In the IdP, you must define roles (also referred to as groups in some IdPs) that map to roles in VMS. Users who use the IdP to sign on to VMS use one of these roles. When a user signs into VMS from the IdP using SSO, they receive permissions in VMS associated with the role in VMS that is mapped to the role in the IdP. If a role does not exist in VMS for the user, the user has only read-only permissions after signing in.

For example, consider a user who has the role VMS Administrators in the IdP, which is mapped to the role VMS Administrators in VMS, with Admin permissions. When the user signs on to VMS from the IdP, they will have Admin permissions in VMS.

Permissions are not preserved for users who sign on to VMS using SSO. This means that if the role for a user on the IdP is changed to a different role, the user will have the permissions of the new role on VMS when they subsequently sign on to VMS.

VMS supports SP-initiated authentication and IdP-initiated authentication with the IdP. In SP-initiated authentication, the selects the SSO sign-on option on VMS, and is redirected to the IdP from there to complete the authentication (for example, Okta).  In IdP-initiated authentication, the user starts in IdP portal and selects VMS from there (for example, JumpCloud).

SAML Attributes Required by VMS for SSO

IdPs must return these attributes in the SAML assertion response for VMS user creation:

  • email. A unique identifier to create or update a user,

  • username.  The name of the user

  • roles. The roles of the user as they appear in the VMS. If this attribute is missing from the assertion, the user only receives read_only permission. For example, if you define a role in VMS called SamlUser with specific permissions, and your IDP roles = SamlUser, all users that are assigned to this role by your IdP will receive this role in VMS with all the permissions you granted for it.

Configuring SSO on a VAST Cluster

Configuring SSO using the VAST Web UI

  1. On the VAST Web UI, navigate to the Administrators page, then select the SSO tab.

  2. Click Add new identity.

  3. In the General section, add these details for the Identity Provider:

    IdP name

    The name of the Identify Provider (e.g. Okta)

    IdP Entity ID

    The Entity ID for the Identity Provider, typically obtained from the metadata.

    Force authenticate

    Forces authentication with the IdP for each sign-on.

  4. In the Metadata section, enter these details:

    Metadata URL

    The URL to the metadata on the IdP, usually in the form

    <https://<idp-url>/sso/saml/metadata

    where idp-url is the URL of the IdP.

    Local metadata

    Use metadata stored locally on VMS. This is an alternative to including a Metadata URL.

    Paste metadata text in the box.

  5. In the Assertions and Certificates section you can optionally enable and configure encryption for SAML assertions and responses. If enabled, you must also provide or upload certificates.

    To enable encryption of SAML assertions, toggle Enable assertion encryption. If enabled, follow these steps to configure a certificate and key.

    1. Click Add certificate.

    2. Paste an X.509 certificate in the box or click Upload, and upload an X.509 certificate file.

    3. Click Save to save the certificate.

    4. Click Add key.

    5. Paste an X.509 key in box or click Upload, and upload an X.509 key file.

    6. Click Save.

    To enable signatures on SAML assertion responses, toggle Enable assertion response signing . If enabled, follow these steps to configure a certificate and key.

    This is enabled independently of the Enable assertion encryption option. The certificate and key used for this option can be different from the ones used for Assertion Encryption.

    1. Click Add certificate.

    2. Paste an X.509 certificate in the box or click Upload, and upload an X.509 certificate file.

    3. Click Save to save the certificate.

    4. Click Add key.

    5. Paste an X.509 key in box or click Upload, and upload an X.509 key file.

    6. Click Save.

    Note

    The selections here for encryption and signing must match the corresponding selections on the IdP. For example, if assertion encryption is set on the VMS, it must also be set on the IdP.

  6. Click Save.

Configure an Identity Provider for SSO using the VAST CLI

On the VAST CLI use the modify-saml command in the vms section to create or modify a configuration for an Identity Provider for Single Sign-On.

Configure a new Identity Provider using the VAST CLI

  • On the VAST CLI, run this command:

    vms modify_saml --idp-entityid <IDP_ENTITYID> --idp-metadata-url <IDP_METADATA_URL> --idp-name <idp-name>

    where IDP_ENTITYID and IDP_METADATA_URL are obtained from  your IdP instance,

    See vms saml_modify for more details about the modify_saml command.

Configure an Identity Provider with encrypted assertions (requires certificate)

  • On the VAST CLI, run this command:

    vms modify_saml --idp-entityid <IDP_ENTITYID> --idp-metadata-url <IDP_METADATA_URL> --idp-name Okta --encrypt_assertion
This action will impact your saml login with Okta.
Are you sure you want to continue? [y/N] y
Please enter idp signing certificate (ALT+ENTER/option+ENTER to finish):
PUT_CERTIFICATE_FILE_CONTENT
Please enter idp signing certificate key (ALT+ENTER/option+ENTER to finish):
PUT_KEY_FILE_CONTENT

    For other options see  vms saml_modify.

Commands for Configuring IdPs for SSO in the VAST CLI

Use the following VAST CLI commands to configure IdPs for SSO.

Login to a VAST Cluster using SSO

Once you have configured VMS for SSO, using your chosen IdP, you can login to VMS using your IDP.

On the VMS login page, click SSO Login With <IDP_Name> .

You are redirected to the IdP to login there, and then back to VMS. Your permissions on VAST Cluster are determined by the permissions configured for you in the IdP.

IDP_Login_Button_VMS.png

If you configured more then one IdP, the SSO Login With  shows a drop down list. Select the provider to use for the login. Your permissions on the VAST Cluster are determined by the permissions configured for you in the selected IdP.

IDP_Login_Dropdown_Button_VMS.png

Note

SSO cannot be configure to access the VAST CLI or REST API.

Configuring the Okta IDP for SSO login to VMS

Okta uses a SAML application to mediate SAML-based SSO. This is configured on Okta.

  1. Sign in to Okta.

  2. select Applications > Create App Integration > SAML 2.0 to create a new SAML application.

  3. Configure your application:

    Config_Okta_Assign_Users_App.png

    1. Enter a name for your application and click Next.

    2. Configure the SSO URL for the VAST Cluster (as the SAML SP) in the format https://<mgmt-vip>/api/saml2/metadata/, where <mgmt-vip> is the Virtual IP address of the VAST Cluster.

      Note

      You can also obtain the SSO URL from VMS by running show_saml_config from the VCLI; the URL is included in the response

      vcli-show-saml-config.png

    3. For the Audience URI (SP Entity ID) enter  https://<mgmt_vip>/api/saml2/metadata/.  where <mgmt_vip> is the VIP for VMS.

    4. Change the Name ID format to EmailAddress and Application username to Email.

    5. If a signed certificate or encryption is required, select Show Advanced Settings and view the certificate in the SP configuration.

    6. Enter the username and email in the Attribute Statements pane. Enter the role Name and Name Format attributes in the Group Attribute Statements pane. With the roles attribute, this configuration enables the IDP to return the correct values for the user creation in VMS.

      Config_Okta_Attribute_Statements.png

    7. Click Next and select I'm an Okta customer adding an internal app, then click Finish.

    8. To create a user, select Directory  > People > Add person.

    9. To create a group, select Directory > Groups > Add group. After creating a group you can select the group name and assign users to it.

  4. Open the Application tab, select the application and click Assign Users to App to assign users to the application. Select the necessary user and click Assign.

    Config_Okta_Assign_Users_App.png
    Config_Okta_Assign_Users_App_2.png

Editing your Okta Application Settings

  1. To edit the Okta application settings in Okta, in the Application tab, select Application > Choose your application. You can then edit your application in the General tab.

  2. To configure your SAML settings click Edit  for the SAML settings.

Related articles