About external authentication configuration
Role: Administrator.
Minimum Version: Ivanti Neurons for ITSM 2024.2.
You can configure the external authentication or third-party Single Sign On (SSO) users for Neurons for ITSM to provide access levels as per the role.
About authentication providers
An authentication provider is a way of linking Neurons for ITSM to a service that provides authentication services for you.
Use the Authentication Providers workspace to manage multiple authentication providers for user accounts with authentication credentials that were already established elsewhere.
There are two ways to add an authentication provider: either manually, as described in Adding an authentication provider manually, and by using metadata, as described in Adding an Authentication Provider by Importing Metadata.
To set up ITSM users for authentication via the Neurons Platform, refer to Setting up ITSM users for authentication via the Neurons Platform and Authentication. This feature is Early Access only and may not be available in your environment. For more information, please contact your Customer Success Manager.
Adding an authentication provider manually
- From the Configuration Console, click Configure > Security Controls > Authentication Providers to open the Authentication Providers workspace.
- From the New Record Menu drop-down list, choose an authentication provider:
Option | Description |
|---|---|
New ADFS/SAML | The customer web portal site acts as the SAML identity provider, and the Neurons for ITSM web application server acts as the service provider. Refer to Setting Up ADFS Authentication in Ivanti Neurons for ITSM. |
New LDAP | You can employ multiple LDAP providers. Refer to Setting Up External Authentication with LDAP. |
New Open ID | Open ID providers (Open ID site, Google, Yahoo, etc.) perform the authentication. When logging into Neurons for ITSM the first time, click the Open ID link. You are redirected to the Open ID site to authenticate. Upon authentication, you are redirected to Neurons for ITSM. Refer to Setting Up Authentication for OpenID. The application stores the cookie used for authentication, and subsequent login attempts skip the redirection. |
New OpenID Connect | Creates an OpenID Connect for Google or Microsoft Azure. Refer to Setting Up Authentication for OpenID Connect with Google and Setting Up authentication for OpenID Connect with Microsoft Azure. |
New Windows Integrated | Allows you to directly set up AD authentication. Refer to . |
Setting Up Users for Authentication
After you create an external authentication provider, you can select it when creating and updating employee records.
Users can click a link on the Neurons for ITSM login page that directs them to their identity provider website and log in from there, or they can use authentication to log in from an URL sent via email, as described in Logging in or Accessing Records Using URLs.
If a user does not have an employee record and if auto provisioning is selected in the authentication provider record, the application creates an employee record for the user when they log in via ADFS/SAML, Open ID, or OpenID Connect. Refer to Setting Up Authentication for ADFS/SAML, Setting Up Authentication for OpenID, Setting Up Authentication for OpenID Connect with Google, and Setting Up authentication for OpenID Connect with Microsoft Azure.
If you are creating only a few users, you can set the authentication provider by following these steps:
- Log in to the Service Desk Console.
- Open the Employee workspace. The application displays a list of employees.
- Open the employee record to set up authentication for.
- From the Details tab, check Enable External Auth.
- For the Login for External Auth field, click Add new.... The application displays the New External Login dialog box.
- Enter data into the fields.
Field | Description |
|---|---|
Login | The login ID for the tenant (UPN) on the domain. The the UPN (user principal name) of the Active Directory user from the ADFS server (for example, [email protected]). |
Authentication Provider | The tenant ADFS that you created. |
- Click Save. The application closes the window.
- Click Save.
When setting up authentication, users must use their external authentication login when logging into Neurons for ITSM, not their internal login ID.
Disable Change Password for External Authentication Users
While configuring the external users that uses Single Sign On (SSO) disable the Change Password feature to avoid security vulnerabilities.
To disable change password feature.
- Log in to Neurons for ITSM as Administrator.
- Open the Configuration console and go to Configure > User and Permissions > Roles and Permissions.
- Select the required role for example DiscoveryAnalyst.
- Disable the Change Password Button under Branding Options and select Save.