How CDO logins work

This is a simplified description of how the IdP account interacts with the Security Cloud Control user record to log in a Security Cloud Control user.

Summary

The key components involved in the CDO login process are:

  • User: Requests access by signing in to a SAML 2.0–compliant identity provider (IdP).

  • Identity provider (IdP): Authenticates the user, issues a SAML assertion, and displays accessible applications, including a tile for Security Cloud Control.

  • CDO: Validates the SAML assertion, extracts the username, and searches tenants for a matching user record.

  • Tenant and role: Control access and determine the actions the user can take.

This process uses SAML-based single sign-on to connect authenticated identities to CDO user records and authorize tenant-specific access.

Workflow

These stages describe how CDO logins work:

  1. The user requests access to Security Cloud Control by logging in to a SAML 2.0-compliant identity provider (IdP) such as Cisco Security Cloud Sign On (https://sign-on.security.cisco.com) for authentication.
  2. The IdP issues a SAML assertion that the user is authentic, and a portal displays the applications the user can access. One of the tiles represents Security Cloud Control.
  3. Security Cloud Control validates the SAML assertion, extracts the username and attempts to find a user record among its tenants that corresponding to that username.
    • If the user has a user record on a single tenant on Security Cloud Control, Security Cloud Control grants the user access to the tenant and the user's role determines the actions they can take.
    • If the user has a user record on more than one tenant, Security Cloud Control presents the authenticated user with a list of tenants they can choose from. The user picks a tenant and is allowed to access the tenant. The user's role on that specific tenant determines the actions they can take.
    • If Security Cloud Control does not have a mapping for the authenticated user to a user record on a tenant, Security Cloud Control displays a landing page giving users the opportunity to learn more about Security Cloud Control or request a free trial.
    Creating a user record in Security Cloud Control does not create an account in the IdP and creating an account in the IdP does not create a user record in Security Cloud Control. Similarly, deleting an account on the IdP does not mean you have deleted the user record from Security Cloud Control; although, without the IdP account, there is no way to authenticate a user to Security Cloud Control. Deleting the Security Cloud Control user record does not mean you have deleted the IdP account; although, without the Security Cloud Control user record, there will be no way for an authenticated user to access a Security Cloud Control tenant.