Virtual Office ---------------------------------------------------------------------------- ------- ---------
Cpyright 2016, 8x8, Inc. All rights reserved. This dcument is prvided fr infrmatin purpses nly and the cntents heref are subject t change withut ntice. This dcument is nt warranted t be errr-free, nr subject t any ther warranties r cnditins, whether expressed rally r implied in law, including implied warranties and cnditins f merchantability r fitness fr a particular purpse. We specifically disclaim any liability with respect t this dcument and n cntractual bligatins are frmed either directly r indirectly by this dcument. This dcument may nt be reprduced r transmitted in any frm r by any means, electrnic r mechanical, fr any purpse, withut ur prir written permissin. 8x8 is a registered trademark f 8x8, Inc. All ther trademarks, service marks, registered trademarks, r registered service marks are the prperty f their respective wner/s. All ther brands and/r prduct names are the trademarks (r registered trademarks) and prperty f their respective wner/s. Versin 1.0 i
Cntents SAML and Ggle Federated Single Sign-On 1 Identity Mapping 1 Cnfiguring Federated Single Sign-On 1 Setting up Single Sign-On 2 Defining Federated ID r Ggle ID 3 Signing in Using Federated SSO 4 Mapping 8x8 User Accunts t Okta 5 Versin 1.0 ii
SAML and Ggle Federated Single Sign-On Custmers with Identity Management Systems like Okta, OneLgin, Ping Identity, and Micrsft ADFS require their emplyees t be able t authenticate t 8x8 apps using their cmpany user name instead f an 8x8 user name and passwrd. In this release, we supprt SAML 2.0 & Ggle OAuth Federated Single Sign-On (SSO) fr the fllwing 8x8 applicatins that use the shared 8x8 lgin web page. Virtual Office Online Virtual Office Desktp Virtual Office Mbile Virtual Cntact Center Accunt Manager Switchbard Pr Virtual Office Analytics With supprt fr federated SSO, users can lg in t 8x8 applicatins thrugh their cmpany's identity management system. Identity Mapping Ideally, the system maps each cmpany user t an 8x8 user via the 8x8 user name. If yur cmpany's 8x8 user names are nt unique email addresses, yu have t ppulate either f these new 8x8 user attributes via Accunt Manager: Federatin ID - fr SAML SSO Ggle ID - fr Ggle SSO Cnfiguring Federated Single Sign-On Cnfiguring access t 8x8 applicatins via federated SSO requires: 1. Setting up SAML in the cmpany's Identity Management System is nt within the cnfines f this dcument since the prcess varies with the Identity Management System adpted by yur cmpany and is typically managed by its administratr. Fr Okta: Search fr "8x8 Inc" in the Okta Applicatin catalg and add it. Fllw the SAML 2.0 setup instructins prvided. Fr OneLgin: Search fr "8x8" in the OneLgin Applicatin catalg. Under Cnfiguratin- >Cnnectrs, select "Cnnectr Versin: SAML 2.0". Versin 1.0 1
2. Setting up Single Sign-On in Accunt Manager is set up by the Virtual Office administratr. The admin must set up Single Sign-On and specify the Identity Prvider used by the cmpany. 3. Defining Federated ID r Ggle ID in User Prfiles is an ptinal step. If the 8x8 user name is nt a unique email address, then yu must add Federatin ID (fr SAML) r Ggle ID (fr Ggle) in the user prfiles. Setting up Single Sign-On 1. Lg in t Accunt Manager. 2. Navigate t Accunts tab. 3. Select Single Sign-On ptin frm the navigatin menu. 4. Select an Identity Prvider frm the fllwing chices: 8x8 Username and Passwrd: Allws users t lg in t 8x8 applicatins using the 8x8 username and passwrd. If this is unchecked, nly the primary administratr can lg in using their 8x8 username and passwrd. All ther users will have t use Ggle r SAML SSO. SAML:Allws users t lg in t 8x8 applicatins by signing via SAML Identity Prvider. Ggle: Allws users t use the Ggle ID t t lg in t 8x8 applicatins. 5. Select the User Mapping Field that maps each user frm yur SAML Identity Prvider r Ggle directry t 8x8. The system begins by matching via 8x8 Username.If that fails, 8x8 lks up and matches via Federatin ID (fr SAML) r Ggle ID fr (Ggle SSO). 8x8 Username: The system maps via 8x8 Username. Federatin ID: Fr SAML, 8x8 maps via Federatin ID. Ggle ID: Fr Ggle Oauth, 8x8 maps via Ggle ID. 6. Save these settings. 7. If yu selected SAML,yu shuld specify the fllwing: Versin 1.0 2
Sign in URL: User authenticatin URL prvided by Identity Prvider (IDP). Sign-Out URL:User sign ut URL prvided by IDP t end the IDP sessin. The 8x8 app will call this URL after yu lg ut f the 8x8 app. if yur IDP can redirect t anther URL after it ends the IDP sessin, yu shuld append the variable string "{8x8Lgut}" which will insert the 8x8 Lgin URL s the user can later re-lgin. Fr Okta, the Sign Out URL shuld be: https://your_ COMPANY.kta.cm/lgin/signut?frmURI={8x8Lgut} Issuer URL: IDP identifier. Identity Prvider Certificate: Yur Identity Management System shuld prvide an X.509 certificate file t dwnlad. Brwse t lcate the certificate file and uplad here. The certificate file is validated and ntifies yu f any errrs. 8. Save the settings. This cmpletes the cnfiguratin f SAML/Ggle federated SSO. Defining Federated ID r Ggle ID If yur cmpany des nt use unique email addresses fr 8x8 username, yu must map Virtual Office user with the Identity Prvider using Federated ID r Ggle ID in 8x8 Accunt Manager. Navigate t user prfiles and ppulate the required mapping field in the user prfile. 1. Navigate t Accunts. 2. Select t view User Prfiles. 3. Based n the chice f identity prvider, the crrespnding mapping field shws. Fr SAML, Federated ID is added. Fr Ggle, Ggle ID is added. Versin 1.0 3
4. Frm the list, edit the desired user prfile t add the mapping field data. Fr SAML, ppulate Federated ID. Fr Ggle, ppulate Ggle ID. 5. Fr batch uplading, dwnlad the csv template, add the desired infrmatin, and uplad the updated CSV file. Fr details n mapping 8x8 user accunts t Okta, click here. Signing in Using Federated SSO The sign in prcess fr 8x8 applicatins is similar whether it is authenticated via SAML r Ggle. The initial sign in prcess navigates users thrugh the Virtual Office lgin page. Navigate t the 8x8 SSO lgin page r launch Virtual Office Desktp. 1. Click the Single Sign-On link in the lg in page. 2. At the prmpt, enter 8x8 user name r cmpany email (Federatin ID r Ggle ID) fr validatin. Yu will cntinue t the custm lgn page f yur cmpany. 3. Lg in using 8x8 username and passwrd r lg in using SAML. Yu will navigate t Identity prvider's lgin page. Fr example, Okta r Ggle. 4. Enter the username and passwrd f the Identity prvider. 5. It launches the 8x8 applicatin panel. If yu fllwed these steps in Virtual Office Desktp, it launches Virtual Office Desktp. The fllwing diagram shws the sign-in prcess using 8x8 credentials fr SAML. Versin 1.0 4
Nte: Fr cnsecutive SSO lg in sessins, yu are ruted frm the custm lgin page (Step 3). Mapping 8x8 User Accunts t Okta Fr Single Sign On, 8x8 needs t match 8x8 user accunts t Okta user accunts. 8x8 users with matching Okta user names If all yur 8x8 users have 8x8 user names (i.e. jde@anycmpany.cm) that match (nt case sensitive) their Okta user names: N additinal 8x8 user cnfiguratin is required fr Single Sign On. 8x8 will use the 8x8 Username field t map each 8x8 user accunt t the Okta user accunt. 8x8 users withut matching Okta user names If yu have any 8x8 users with 8x8 Usernames (i.e. PBX_NAME.EXT#) that d nt match their Okta Usernames, yu will need t ppulate the 8x8 Federatin ID field fr each f these users: 1. Lg in t 8x8 Accunt Manager. 2. Navigate t Accunts > User Prfiles > Edit user prfile. 3. T update individual user prfiles: a. Select a user prfile and click Edit. b. Ppulate the Federatin ID field with the Okta Username. 4. T update user prfiles in batch: Versin 1.0 5
a. Click Dwnlad CSV Template. b. Open the dwnladed Prfiles_***.csv file in Micrsft Excel r any spreadsheet app. c. Ppulate the Federatin ID field fr each user with the Okta Username and save the file. d. Frm 8x8 Accunt Manager, click Uplad CSV Template t uplad the edited Prfiles_***.csv file. 5. Save all changes. 8x8 will nw use the 8x8 Federatin ID field t map the 8x8 user accunt t the Okta user accunt fr Single Sign On. Versin 1.0 6