Authentication Setup¶

This guide covers authentication configuration in SPSA.

Authentication Methods¶

SPSA supports multiple authentication methods:

Local Authentication¶

Overview¶

Local authentication uses SPSA's built-in user database. This is the default and works with all editions.

Create Local Users¶

1. Go to Settings > Users
2. Click New User
3. Set username and password
4. Configure MFA enrollment
5. Save

Multi-Factor Authentication (MFA)¶

TOTP Authentication¶

SPSA requires TOTP-based MFA for all portal users. Compatible authenticator apps:

• Google Authenticator
• Microsoft Authenticator
• Authy
• Any TOTP-compatible app

Cisco DUO Authentication¶

SPSA supports Cisco DUO for enterprise MFA:

1. Configure DUO application in DUO Admin Panel
2. Configure SPSA with DUO integration keys
3. Users authenticate via DUO push, SMS, or hardware token

Contact Skillplan for DUO configuration assistance.

Active Directory Integration¶

SPSA integrates with Active Directory for authentication and user management.

Requirements¶

• Network connectivity from SPSA to Domain Controller
• Service account with read access to AD
• LDAP/LDAPS port accessibility (389/636)

Configuration Overview¶

AD integration is configured through the SPSA Portal. Contact Skillplan for detailed setup assistance.

Microsoft Entra ID Integration¶

SPSA supports Microsoft Entra ID (formerly Azure Active Directory) for Single Sign-On using:

• SAML 2.0 - Established standard with broad support
• OpenID Connect (OIDC) - Modern OAuth 2.0-based protocol

Architecture Overview¶

Protocol Comparison¶

SAML 2.0 Configuration with Entra ID¶

Step 1: Create Enterprise Application in Entra ID¶

1. Sign in to Azure Portal: https://portal.azure.com
2. Navigate to: Microsoft Entra ID → Enterprise applications
3. Click New application
4. Select Create your own application
5. Enter a name (e.g., "SPSA Portal")
6. Select Integrate any other application you don't find in the gallery (Non-gallery)
7. Click Create

Step 2: Configure SAML Single Sign-On¶

1. In the created Enterprise Application, navigate to Single sign-on
2. Select SAML
3. Click Edit on Basic SAML Configuration
4. Configure the following values:

Step 3: Download SAML Metadata¶

1. Scroll to SAML Certificates
2. Copy the App Federation Metadata URL
3. Or download the Federation Metadata XML file

Save the metadata URL for SPSA configuration.

Step 4: Assign Users and Groups¶

1. Navigate to Users and groups
2. Click Add user/group
3. Select the users and/or groups that should have access to SPSA
4. Click Assign

Step 5: Configure SPSA for SAML¶

Contact Skillplan support to configure SPSA with your SAML settings. You will need:

• App Federation Metadata URL (from Step 3)
• Entity ID (from Step 2)
• Callback URL (from Step 2)

Step 6: Create SPSA Users¶

1. Log in to SPSA Portal with local admin account
2. Go to Settings → Users
3. Create users with email addresses matching Entra ID
4. Important: Do NOT set a password for SAML users
5. Assign appropriate connection permissions

OpenID Connect (OIDC) Configuration with Entra ID¶

Step 1: Create App Registration in Entra ID¶

1. Sign in to Azure Portal: https://portal.azure.com
2. Navigate to: Microsoft Entra ID → App registrations
3. Click New registration
4. Enter a name (e.g., "SPSA OIDC")
5. Select Accounts in this organizational directory only (Single tenant)
6. Configure Redirect URI:
7. Platform: Web
8. URI: https://spsa.yourdomain.com/guacamole/
9. Click Register

Step 2: Note Client ID and Tenant ID¶

After registration, note the following from the Overview page:

Step 3: Enable Implicit Flow¶

1. Navigate to Authentication
2. Under Implicit grant and hybrid flows:
3. Enable ID tokens (used for implicit and hybrid flows)
4. Click Save

Step 4: Configure API Permissions¶

1. Navigate to API permissions
2. Ensure the following permissions are present:
3. openid
4. profile
5. email
6. User.Read

Step 5: Configure Groups Claims (Optional)¶

To pass group membership to SPSA:

1. Navigate to Token configuration
2. Click Add groups claim
3. Select Security groups
4. Under ID: Enable Group ID
5. Click Add

Step 6: Construct Discovery URL¶

The OpenID Connect Discovery URL for Entra ID:

https://login.microsoftonline.com/{TENANT-ID}/v2.0/.well-known/openid-configuration

Replace {TENANT-ID} with your Directory (tenant) ID from Step 2.

Step 7: Configure SPSA for OIDC¶

Contact Skillplan support to configure SPSA with your OIDC settings. You will need:

Step 8: Create SPSA Users¶

1. Log in to SPSA Portal with local admin account
2. Go to Settings → Users
3. Create users with usernames matching Entra ID (typically email or UPN)
4. Important: Do NOT set a password for OIDC users
5. Assign appropriate connection permissions

Conditional Access Policies¶

When using Entra ID, you can leverage Conditional Access Policies for enhanced security:

Configure Conditional Access¶

1. In Azure Portal, navigate to Microsoft Entra ID → Security → Conditional Access
2. Click New policy
3. Configure:
4. Users: Select users/groups
5. Cloud apps: Select your SPSA application
6. Conditions: Configure location, device, risk level
7. Grant: Require MFA, compliant device, etc.
8. Enable policy and save

Troubleshooting¶

SAML Issues¶

OIDC Issues¶

General Issues¶

Best Practices¶

Security Recommendations¶

1. Always use HTTPS - SPSA uses Caddy for automatic SSL
2. Implement Conditional Access - Use Entra ID policies for MFA, location, device compliance
3. Use Groups for Access Management - Create dedicated Entra ID groups for SPSA access
4. Limit Network Access - SPSA should only be accessible to authorized networks
5. Enable Audit Logging - Monitor Entra ID sign-in logs and SPSA session history
6. Regular Access Reviews - Periodically review user access in both Entra ID and SPSA

User Management¶

Support¶

For authentication setup assistance: