Overview of Single Sign-On

To enhance the security of your organization's Red Canary account, we recommend implementing a Single Sign-On (SSO) provider for user authentication. Requiring users to log in via SSP is a highly effective method for safeguarding your Red Canary data.

While Red Canary is compatible with most Security Assertion Markup Language (SAML)-compliant identity providers, we offer detailed setup instructions for these popular providers:

• Set Up SSO with Duo

• Set Up SSO with Microsoft Entra ID Protection

• Set Up SSO with Okta

• Set Up SSO with OneLogin

• Set Up SSO with Ping Identity

Require SSO Login for All Users

Note

Before enabling this setting, make sure your SSO setup is active and tested. If your identity provider stops working after you enable the setting, you’ll need to submit a Red Canary support case so we can administratively disable this requirement.

You can configure Red Canary so that all users are required to log in using SSO:

1. Click your user icon at the top right of your Red Canary, and then click Single Sign-On.

2. Under Authentication Methods, check Disable username / password login and require login via Single Sign On.

3. Click Save.

Automatically Provision New Users via SSO Login

Note

Before enabling this option, make sure you’ve configured your identity provider to only allow the appropriate users access to Red Canary.

You can configure Red Canary to automatically provision new Red Canary users upon first SSO login:

• To automatically create Red Canary accounts when users sign in via SSO:

1. Click your user icon at the top right of your Red Canary, and then click Single Sign-On.

2. Under User Provisioning, check Automatically create a Red Canary user the first time a user is authenticated.

3. Choose which role(s) you would like granted to users that are automatically created via SSO.

4. Click Save.

• To re-grant roles to users when they log in via SSO:

1. Click your user icon at the top right of your Red Canary, and then click Single Sign-On.

2. Select Grant these roles on EVERY sign in.

3. Click Save.

FAQs

Troubleshooting

You can use audit logs to troubleshoot configuration failures and unexpected responses from your identity provider or Red Canary:

1. Click your user icon at the top right of your Red Canary, and then click Audit logs.

2. Click the Filter for audit logs dropdown and choose SSO Login Failure.

   Note: You can also choose Learn more about filtering for audit logs, and select SSO Login Failure.

SAML response was missing email_attribute=[user.mail], had attributes=[["http://schemas.microsoft.com/identity/claims/tenantid", "http://schemas.microsoft.com/identity/claims/objectidentifier", "http://schemas.microsoft.com/identity/claims/identityprovider", "http://schemas.microsoft.com/claims/authnmethodsreferences", "LastName", "FirstName", "Email"]] and name_id=email@company.com

SAML response had errors [["Invalid Audience. The audience https://my.redcanary.co/, did not match the expected audience https://my.redcanary.co"]]

User has no roles on this domain and SSO auto-granting of roles is disabled