• Replies 11 replies
  • Subscribers 0 subscribers
  • Views 71 views
  • Users 0 members are here
Options
3sides - Social sharing widget
Related

HighQ and SSO

Athar Agha
27289

Not sure if this is possible but curious as to current capabilities..

I understand that HighQ can accept identity providers 'upstream', in that placing an IDP 'before' HighQ will allow authentication into HighQ ("You've logged into Okta, so you can now access HighQ").  Is there any capabilities that will allow HighQ to act as an IDP?   ("You've logged in to HighQ so you can now access site x") ? 

i.e. we want to be able to validate a user login request at HighQ and pass that SAML response downstream instead of it stopping at HighQ so we can authenticate other systems..

I know this wasn't possible last year as it looked like there was no way to pass that response downstream, but wondering if things have changed now that TR are at the helm?

Thanks

Parents
  • Thomson Reuters Thomson Reuters staff member

    So the 'flow' described by Athar Agha as 1) is more-or-less what we currently do (as I understand it), when you have SSO configured.
     

    Mark Salamon is the kind of authentication you are talking about where you visit a webapp and it has a 'login with Facebook/Github/Whatever' button?

    FWIW on occasion, we have set up external users (i.e clients of our clients) SSO in instances. IDP discovery looks at IP address/range and seeing as 99.9999% of our clients enforce the use of a corporate vpn, its perfectly possible to have us forward users coming from different locations to different authnetication services. Would need to check with Pro Services Daniel Rahman just to be sure :-) as I might've fudged a detail here, but at a high level, I've seen it done.

Reply
  • Thomson Reuters Thomson Reuters staff member

    So the 'flow' described by Athar Agha as 1) is more-or-less what we currently do (as I understand it), when you have SSO configured.
     

    Mark Salamon is the kind of authentication you are talking about where you visit a webapp and it has a 'login with Facebook/Github/Whatever' button?

    FWIW on occasion, we have set up external users (i.e clients of our clients) SSO in instances. IDP discovery looks at IP address/range and seeing as 99.9999% of our clients enforce the use of a corporate vpn, its perfectly possible to have us forward users coming from different locations to different authnetication services. Would need to check with Pro Services Daniel Rahman just to be sure :-) as I might've fudged a detail here, but at a high level, I've seen it done.

Children
No Data