Add multiple single sign-on providers to Genesys Cloud

  • Single Sign-on > Provider > Add, Delete, Edit, and View permissions
  • Admin role in your organization’s identity provider account
  • A single email address for both the identity provider account and Genesys Cloud
  • Metadata from your identity provider
  • An encoded public certificate from your identity provider
Important: You must add Genesys Cloud as an application that organization members can access with their single sign-on provider account.

Genesys Cloud allows you to configure up to 30 single sign-on (SSO) integrations with the same identity provider or a mix of identity providers. To help you create your SSO integrations, Genesys Cloud provides the ability to import a SAML metadata file that you receive from your identity provider. Importing a SAML metadata file, which contains all of the relevant configuration details and certificate information, automatically populates the necessary fields in the integration.

Single Sign-On page

To make it easy to keep track of multiple SSO integrations, Genesys Cloud displays all of the integrations as a list on the Single Sign-On page. The page provides a summary of each integration including the login name, logo, identity provider, and certificate expiration details. In the Action column, you can click More to display a short menu that allows you to edit and delete an integration. On the Name, Identity Provider, and Certificate Expiration column headers, you can click Sort   to rearrange the view in ascending or descending order.

The page also provides options that allow you to add an identity provider and download a Genesys certificate. You can click Download Genesys Certificate anytime you need to have a Genesys certificate to send to an identity provider.

Single Sign-On page

Customize login screen for each SSO integration

You can customize how to display each SSO integration with a different login name and a logo of your choice. You can even choose to display only the name or only the logo; or display both the name and logo. The choice you make determines how the SSO integration displays on the Single Sign-On and Genesys Cloud login page.

To conserve space, only six SSO integrations can appear directly on the Genesys Cloud login page.

Genesys Cloud login screen with six SSO integrations.

If you have more than six SSO integrations, they will appear in a drop down list on the login page.

Genesys Cloud login screen with more than six SSO integrations.

Create an SSO integration

SAML authentication

As an additional security measure, Genesys Cloud provides the ability to sign authentication requests. A signed authentication request is a SAML (Security Assertion Markup Language) request that has been digitally signed to ensure its authenticity and integrity.

Genesys Cloud metadata 

To configure an SSO integration between Genesys Cloud and an identity provider, you need to configure settings on both ends. Identity providers supply you with a metadata file that contains the Issuer URI, Single Sign-On URI, and Single Logout URI that you need to enter into Genesys Cloud as you configure your organization’s identity provider account. You can generate a SAML metadata file that contains all of the Genesys Cloud metadata and certificate information that an identity provider needs to configure settings on their end. 

To create an SSO integration:

  1. Click Admin.
  2. Under Integrations, click Single Sign-on.
  3. Click Menu > IT and Integrations > Single Sign-on.
  4. Click Add an Identity Provider.
  5. Enter the name that you want to assign to your integration.
  6. To display the logo on the Genesys Cloud login page, select Display Name On Login Page.
    Note: If you have more than six identity providers, the Display Name On Login Page option is not available.
  7. Click Identity Provider Name and you can select one of the available, fully supported, identity providers or enter a new identity provider name.
    Note: The Identity Provider Name list contains a set of the most common providers. If you do not see your identity provider listed, you can add them by typing their name. Once you save the configuration, the new identity provider will be included in the list.
  8. Click Select logo and upload the logo image file that you want to display on the login page. Alternatively, you can drag and drop the logo image file.
    Note: The logo image file must be in SVG format and cannot be larger than 25 KB in size.
  9. In the Identity Provider Data section, click Select SAML metadata to import to import the metadata file that your identity provider sent to you. Alternatively, you can drag and drop the metadata file.

After you import the metadata file, you’ll see that all of the required fields are automatically populated. You’ll also find that the encoded public x509 certificate for SAML signature validation is available as well.


Field Description
Issuer URI The identity provider’s Issuer ID.
Single Sign-On URI The identity provider’s Single Sign On URL.
Single Sign-On Binding The sign-on binding that your identity provider specified.
Sign Authentication Requests Select the Sign Authentication Requests check box if you want to add an extra layer of security to verify that requests are coming from a verified source.
Single Logout URI The logout URL that your identity provider specified.
Single Logout Binding The logout binding that your identity provider specified. If no binding is specified, select HTTP Redirect.
Name Identifier Format The format that your identity provider specified. If the format is unknown, select Unspecified.
Certificate

X.509 certificates for SAML signature validation. Uploaded certificates appear with their expiration date. You can have up to five certificates per SSO configuration. Genesys Cloud chooses the correct certificate during single sign-on and logout.

To upload additional certificates, click Select certificates to upload and upload the certificate. Alternatively, you can drag and drop the certificate.

To remove a certificate, click X.

  1. Click Save.

Genesys Cloud service provider data

When you you click Save, Genesys Cloud generates the SAML metadata that your identity provider will use when configuring your identity provider account. 

Note: The generated metadate file includes the Issuer URI, the Assertion Consumer Service, and the Single Logout URI.
  • To download a SAML metadata file that contains all of the Genesys Cloud metadata and certificate information that an identity provider needs to configure settings on their end, under Genesys Cloud Metadata, click Download Metadata.
  • If you only need to have a Genesys certificate to send to an identity provider, under Single Logout URI, click Download Certificate.