Lyyti supports the SAML 2.0 protocol for Single Sign-On. It enables the Service Provider ("SP", ie. Lyyti) and Identity Provider ("IdP", whatever you use for managing logins) to share their authentication and authorization data using standardized XML metadata.
- SAML 2.0 SP metadata as XML: https://www.lyyti.fi/access/saml2/metadata/YOUR_ID_HERE
- Entity ID: https://www.lyyti.fi/
- ACS: https://www.lyyti.fi/access/saml2/acs/YOUR_ID_HERE
- URL to initiate SSO: https://www.lyyti.fi/access/saml2/sso/YOUR_ID_HERE
- The only Name ID (ie. what is used to identify the account attempting login) needed is the user's email address
- Sign responses, but not requests
- Note: The email provided by your IdP as the user's NameID must match the user's Lyyti account email
Once you have entered these SP settings and the XML metadata into your SAML 2.0 configuration, please provide us the IdP metadata in XML format. The SSO and ACS URLs provided above will become functional only after we have received and processed the metadata.
The only currently available Lyyti-specific setting regarding SSO is the decision whether or not to allow SSO discovery by user email. What this means is that in order for the Lyyti login page (https://www.lyyti.fi/login/) to work, it needs to know the SSO URL of the user attempting to log in.
Because this happens, by definition, before the user has logged in, the discovery process is "public" in that anyone could theoretically test different user emails to find out a) that such an account exists and b) what kind of SSO they use to log in. This may or may not be a significant detail for your organization's cybersecurity strategy. A common practice these days seems to be to enable public discovery, but Lyyti supports both options.
If you choose to disallow SSO discovery by email, then the Lyyti login page will not work for your organization's users, and you must direct the users to the organization-specific SSO URL provided above. By default, we will not turn discovery by email on, so please inform us if you decide to allow it.
Updated almost 4 years ago