EIP provides single login/single sign-on with Microsoft Entra Single Sign-on for the organization. This service allows users to authenticate with their standard UCAR CIT Active Directory (AD) account, and if enrolled, DUO multi-factor authentication (MFA), with applications where a trust has been established. This allows for a more simplified authentication experience for our customers in reducing the number of usernames and passwords needed as well as establishes a more secure authentication method with MFA enabled.
The purpose of this document is to provide information on the terminology used for the single login infrastructure, outline roles and responsibilities for both EIP and the application owner, and give general information on the technical setup that is needed to create a trust as well as support the trust.
| Term | Definition |
|---|---|
| Authentication | Confirming your identity |
| Authorization | Granting access to a system |
| Active Directory | Microsoft’s management technology for managing users and computers access and authorization to our network resources from a single directory. Our domain for UCAR is CIT. |
| Microsoft Entra Single Sign-on (SSO) | Microsoft’s cloud-based single sign- on system used with CIT authentication. A trust is created within Entra IDEntra SSO between Entra SSOEntra SSO and the application. |
| Multi-Factor Authentication (MFA) | DUO is our current MFA solution that is used in combination with your CIT username and password in conjunction with a third method of authenticating including a push to the DUO app on your smartphone. |
| Identity Provider (IdP) | An identity provider implements and manages the framework for authentication and authorization federation. EIP as the administrators of AD, Entra SSO, and DUO are the identity providers for the organization. |
| Service Provider (SP) | The administrator or owner of the application and federation partner with the IdP providing service to the end user. |
Service-Level Agreements (SLAs)
In general please start with a ticket request and then EIP will work with you to establish the trust between your application and Entra SSO. Each trust needs the following information in order to be created. At the same time, we have also found that each trust can have an extra component to set up that can only be determined through testing. Please submit a request for a trust to be configured.
The first step is to determine if your environment should be set up in a TEST domain, CIT domain, or both depending on your environment. During the trust setup process, we will test with you to confirm authentication is working with your application. In preparation for a request, the following technical details are needed to get started.