Setting Up Single Sign On

Edit online

Single Sign On (SSO) allows your team to log in to IBM Digital Asset Haven using your existing identity provider. This enhances security by centralizing user authentication and management. IBM Digital Asset Haven SSO supports all OpenID Connect (OIDC) providers. You can configure your organization to use SSO and automatically redirect users when they log in to IBM Digital Asset Haven.

Before you begin

Ensure you have access to:
  • Your IBM Digital Asset Haven account with sufficient permissions.
  • Your organization’s identity provider (for example, Okta, Entra, or Google Workspace) with sufficient permissions.

Procedure

  1. Initiate SSO Configuration in IBM Digital Asset Haven
    1. Log in to the IBM Digital Asset Haven dashboard and navigate to Settings > SSO.
    2. Select Activate SSO for this organization.
    3. Copy the Redirect URL. You will need this to configure your identity provider.
      If you are building another frontend for customers, you can add their redirect URLs here.
  2. Configure Your Identity Provider
    Set up an application in your identity provider’s dashboard. Instructions for detailed tutorials for some common providers are provided below:
    1. Okta: Step-by-step tutorial
    2. Entra ID (formerly Azure AD): Step-by-step tutorial
    3. Google Workspace: Step-by-step tutorial
    Each tutorial covers registering an application, configuring redirect URIs, and obtaining client credentials (Client ID and Client Secret).
  3. Finalize SSO Configuration in IBM Digital Asset Haven
    1. Return to the SSO configuration page in IBM Digital Asset Haven.
    2. Enter the following information from your identity provider:
      OpenID Configuration URL: configuration URL (for Okta and Entra ID) or issuer URL (for other OIDC providers)
      Client ID
      Client Secret
    3. Click Save.
  4. Invite Users with SSO
    1. Go to the Users page.
    2. Select Invite a new user.
    3. In the form, check Require SSO to enforce login through SSO.
  5. Require SSO for Existing Users
    1. Go to the Users page.
    2. Open the menu for a user and enable Require SSO.
      This step requires the Auth:Users:Update permission.
  6. Log Users in Through SSO
    Once SSO is enabled, users will be redirected to your identity provider login page:
    1. Default IBM Digital Asset Haven dashboard login : Users sign in with their passkey, and then are redirected to SSO.
    2. Direct SSO URL: Users log in directly and are redirected to the IBM Digital Asset Haven dashboard.
    3. IBM Digital Asset Haven SSO redirection URL: Users are redirected to SSO automatically, without using a passkey.

Results

Your SSO integration is now complete. Team members can log in to IBM Digital Asset Haven using their identity provider credentials.

If you encounter issues, contact IBM Digital Asset Haven Support.