Configure SSO for Opsgenie

Opsgenie offers several providers for Single Sign On solution in which you can control authentication of the hosted accounts on your identity provider to Opsgenie. Authentication via Single Sign-On is available on both Opsgenie web and mobile applications.

What are the benefits of Single Sign-On?

Using a Single Sign-On solution, you can:

• Reduce password fatigue: You have to remember one less password. Users of your organization who are granted access to Opsgenie do not need to set or use password on Opsgenie to login and use our features.

• Easily manage user access: You can grant/prohibit access to Opsgenie for your users using the console of your identity provider without being have to login Opsgenie. Administrator's ability to manage users and their configurations is improved.

• Improve security: Assertions that are generated by your identity provider are used while you are authenticating to Opsgenie instead of passwords that are created by users. Furthermore, your organization can easily enforce your users to choose a strong password that will work with any service your organization uses. Also, our mobile apps do not keep user passwords for the users who use our SSO solution; tokens that will be invalidated on next login are kept instead.

• Reduce help desk costs: Organizations that use many different services can greatly reduce the amount of recoveries for single accounts.

Our Identity Provider Partners

• Google: Click here for instructions needed to setup SSO integration with Google.

• Microsoft Active Directory Federation Services (AD FS): Click here for instructions needed to setup SSO integration with Microsoft ADFS.

• Azure Active Directory: Click here for instructions needed to setup SSO integration with Azure Active Directory.

• OneLogin: Click here for instructions needed to setup SSO integration with OneLogin.

• Okta: Click here for instructions needed to setup SSO integration with Okta.

• PingIdentity: Click here for instructions needed to setup SSO integration with Ping Identity.

• Generic Support: Click here for instructions and information needed to setup SSO integration with an identity provider that is currently not one of our partners.

Configuring Single Sign-On for Opsgenie

1. Navigate to Single Sign-On page within Opsgenie Web Application. This page is the place to configure your Single Sign-On Settings.

2. Select your identity provider from among the list of available identity providers as above. If your identity provider is not one of our Single Sign-On partners, you can select the SAML 2.0 segment that provides a generic configuration for other SAML 2.0 based SSO identity providers.

3. The setup instructions of each identity provider are available within both the configuration page and the related document under the Our Identity Provider Partners section.

After you save your SSO configuration, you can start using the Opsgenie Login page to login to Opsgenie:

• Go to Opsgenie's standard Login page and enter your email address. If your email address belongs to multiple account, you will be asked to enter your customer name as well.

• As soon as you login to your identity provider, you'll be redirected and logged in to Opsgenie.

While your account has enabled SSO, all users in your account will have to use Opsgenie Login page to login to Opsgenie. Login attempts with username/password credentials will not work.

When you add a new user to your SSO-enabled account, upon verification the user can immediately start using Opsgenie, without the need to specify a password.

Provisioning new users automatically

If you have "Provision new users on the first login automatically." setting as enabled, Opsgenie will create and add your users to your account automatically, on their first login via SSO. The first login in this case must be initiated in the Identity provider.

Points on auto-provisioning new users:

• Opsgenie will create the user based on the e-mail address used for login, i.e for james@opsgenie.com, a new user with username james@opsgenie.com and name james will be created in Opsgenie.

• The new user, upon first login, will be created, verified and logged in automatically.

• The first login must be initiated in the identity provider.

Disabling SSO

If you'd like to disable SSO, go to the SSO page, uncheck the "Enabled" field and save. Upon disable, an informational e-mail will be sent to your users, directing them to use their passwords to authenticate to Opsgenie from now on. Users without a password will be sent a link that they can use to specify their passwords.

When SSO is disabled, login attempts via SSO will not work.

To enable SSO back, you can check "Enabled" and save again in the SSO page. Upon enable, an informational e-mail will be sent to your users, directing them to use the Opsgenie Login page to login to Opsgenie from now on.