Skip to content
Wasp AssetWasp AssetWasp Asset Help

Single Sign-On (SSO)

Single Sign-On (SSO) lets your users sign in to Wasp Asset through your organization’s own identity provider (IdP) instead of a separate Wasp Asset password. Wasp Asset supports two methods: ADFS (WS-Federation) and SAML 2.0.

Before you begin

Section titled “Before you begin”
  • SSO is set up by an administrator under the Settings gear, gated by your role’s permissions.
  • The Single Sign On section only appears if single sign-on is enabled for your organization’s account. If you don’t see it, contact Wasp about enabling it.
  • Set up outgoing email first. SSO validation is blocked until SMTP is configured.
  • Each person who signs in with SSO still needs an active Wasp Asset user account — SSO handles sign-in, it doesn’t create accounts on its own. See Users & administration.
  • Have your identity provider’s details ready (metadata URL for ADFS; sign-in URL and signing certificate for SAML).

Choose a login option

Section titled “Choose a login option”

Open Settings gear → Options → Single Sign On, and set Login Option to one of:

  • WaspCloud — the default; users sign in with their Wasp Asset username and password (SSO off).
  • Federated (ADFS) — sign in through an AD FS server.
  • SAML — sign in through any SAML 2.0 identity provider.

Choosing ADFS or SAML shows the fields for that method.

Set up ADFS

Section titled “Set up ADFS”

Provide your AD FS Metadata URL. If Wasp Asset can’t validate the certificate chain for that endpoint, tick Ignore Chain Errors and supply the certificate Thumbprint.

Set up SAML

Section titled “Set up SAML”

Wasp Asset shows two read-only values — an SSO URL (the address the IdP posts back to) and an Entity Id — that you give to your SAML identity provider when you register Wasp Asset as an application there.

Then provide your IdP’s details in Wasp Asset:

  • SAML Url — your identity provider’s sign-in URL.
  • Certificate — your identity provider’s X.509 signing certificate.
  • Validate Signature and Include AuthnContext — optional security settings.

To save typing, you can upload your IdP’s metadata XML (or point Wasp Asset at its metadata URL) to auto-fill the SAML Url and Certificate, then adjust anything by hand.

Validate and save

Section titled “Validate and save”

Click Validate for the method you chose. Wasp Asset sends you through your identity provider’s real sign-in, then checks that it comes back with a matching email and role for your own account. On success, the configuration is marked valid; click Save to store it. If validation fails, the page explains why (for example, a mismatched email, a role/group that doesn’t match, an invalid certificate or URL, or that cookies must be enabled).

How users sign in afterward

Section titled “How users sign in afterward”

Once SSO is set up and active, the sign-in page sends users to your identity provider automatically — they authenticate there and are returned to Wasp Asset. Wasp Asset matches them to an existing user account by email address, so:

  • The person must already have an active Wasp Asset account with a matching email.
  • Their identity provider group must match their Wasp Asset role name.

Troubleshooting

Section titled “Troubleshooting”
  • I don’t see the Single Sign On section. It only appears when SSO is enabled for your organization. Contact Wasp about enabling it.
  • The Validate button is disabled. Configure and validate your outgoing email (SMTP) first.
  • A user gets “user has not been registered.” No active Wasp Asset account matches the email their identity provider returned. Add the user under Users & administration first.
  • A user is rejected for their group/role. The group their identity provider sends must match a Wasp Asset role name. Align the names and try again.
Section titled “Related”