Skip to content
Docs
foxborne.comRequest a pilot

Single sign-on

Connect Foxborne to your identity provider over SAML 2.0, so people sign in with the account they already have and acknowledge the system use notice first. Only the break-glass account signs in locally.

How-toEvery deploymentAdminMarkdown
On this page8

Single sign-on puts every sign-in behind your identity provider, so the accounts and controls you already run decide who reaches the evidence. Foxborne supports single sign-on over SAML 2.0 or OIDC. The Sign-in tab under Access configures SAML 2.0, and this page covers it.

Single sign-on is required for everyone except the break-glass account, which exists for the day the identity provider is down.

Before you start#

  • You need the Admin role. Only admins hold Manage hosting, keys and access.
  • You can create a SAML 2.0 application in your identity provider and assign people to it.
  • You have picked a quiet moment. Changing the identity provider signs everyone out.
  • The break-glass account and its hardware security key are at hand, in case sign-in fails.

Connect your identity provider#

  1. Open the sign-in settings

    In the console, go to Access and open the Sign-in tab. The Single sign-on panel shows the connection Foxborne uses today.

    Protocol
    SAML 2.0
    Identity provider
    Okta
    Entity ID
    https://foxborne.hfr.internal/saml/metadata
    Reply URL
    https://foxborne.hfr.internal/saml/acs
    Signing certificate
    Expires 14 Mar 2028
    Required
    Yes, for everyone except the break-glass account

    These values come from the example dataset. On your deployment, Entity ID and Reply URL start with its own host name.

  2. Register Foxborne in your identity provider

    Create a SAML 2.0 application for Foxborne. Enter the Entity ID as the service provider's entity ID, which some providers call the audience. Enter the Reply URL as the assertion consumer service URL.

    Assign the application to the people who use Foxborne. With SCIM on, assign the five Foxborne groups instead, as SCIM provisioning describes.

  3. Release the US person attribute

    If your deployment enforces export control, add an attribute named usPerson to the assertion. Evidence marked EXPT opens only for users whose identity provider asserts US person status. Export-controlled evidence covers the attribute.

  4. Give Foxborne your provider's metadata

    Select Edit on the Single sign-on panel. The Single sign-on dialog opens with the warning Changing the identity provider signs everyone out.

    Enter the address of your provider's SAML metadata in Metadata URL. The Signing certificate field is read-only. Select Save.

    The console confirms Metadata refreshed. Nothing else changed. The audit log records Changed SSO settings on Access, with the detail Metadata refreshed.

  5. Sign in through your provider

    Open the console in a private browser window. Read the system use notice, tick I understand and consent, then select Continue with and your provider's name, such as Continue with Okta.

    Your provider signs you in and returns you to Incidents. The console confirms Signed in as and your name.

The sign-in screen#

The sign-in screen has no sidebar, top bar or status bar. Its card holds, from top to bottom:

  1. The Foxborne logo, Sign in and a line naming your organization and its identity provider.
  2. A tile with your organization's initials, its name and the deployment's host name.
  3. The System use notice, with the checkbox I understand and consent.
  4. Continue with and your provider's name, disabled until the checkbox is ticked.
  5. The Break-glass access divider, an Email field and Use a hardware security key.

Under the card, a line names the version and where it runs, such as Foxborne 1.4.2, self-hosted in AWS GovCloud (US-West).

The notice is acknowledged before every session. Each acknowledgment writes Acknowledged notice on Sign-in to the audit log, with the detail System use notice. Admins write the notice in Settings, as CUI marking describes.

Break-glass access#

The break-glass account is a local account for when the identity provider is down. It requires a hardware security key, and passwords alone are refused. The Break-glass access panel on the Sign-in tab names the account and states both rules:

  • Every break-glass sign-in is audited and raises an alert in your SIEM.
  • Requires a hardware security key. Passwords alone are refused.

To use it, enter the account's email under Break-glass access on the sign-in screen and select Use a hardware security key. When the console shows Touch your security key to continue, touch the key. The audit log records the sign-in, such as Signed in on Local account with the detail Break-glass admin with hardware key.

On Members, the break-glass account shows Local, hardware key under Sign-in and carries a Break-glass chip.

Sessions#

Once someone is signed in, the session policy decides how long they stay signed in. The Sessions panel on the same tab shows the Idle timeout, the Longest session, Two-factor and the allowed Networks. Set the session policy walks through each option.

Check the result#

  • The Single sign-on panel names your provider under Identity provider and shows an expiry date under Signing certificate.
  • On Members, people who signed in through your provider show Single sign-on under Sign-in.
  • The audit log holds a Changed SSO settings entry, then an Acknowledged notice entry for each sign-in.

Troubleshoot#

Continue with your provider stays disabled. The consent box is not ticked. Tick I understand and consent: the notice is acknowledged before every session.

Everyone was signed out. Changing the identity provider signs everyone out, as the dialog warns. People sign in again through the new provider.

The identity provider is down. Sign in with the break-glass account and its hardware security key. Every use is audited and alerts your security team.

The Email field turns red on the break-glass path. The field is empty. Enter the break-glass account's email, then select Use a hardware security key again.

A signed-in person cannot open export-controlled evidence. Their US person column on Members reads Not asserted. See Export-controlled evidence.

Next#