Single sign-on authentication

​

OIDC Authentication

​

Create users in Lucidworks Platform

1. Navigate to the megamenu and click Settings > Users & Provisioning > Users.
2. Verify all necessary users are listed, active, and their emails match their identity provider user counterparts.
3. If any users are missing, add the appropriate users by completing the steps in invite workspace owners.

​

Create an OIDC application in your identity provider

1. Create a new OIDC application in your identity provider. Refer to your provider’s documentation for detailed steps:
   • Okta
   • Microsoft Entra ID
   • Google Workspace
2. When creating the application, use the following settings:
   • Sign-in method: Select OIDC.
   • Application type: Select Web Application.
   • Sign-in redirect URIs: Leave this blank for now. You’ll configure it in a later step.
   • Logout redirect URIs: Remove all URIs.
   • Controlled access: Allow everyone in your organization to access the application.
   • Access approval: Disable any setting that grants users immediate access without admin approval.
3. After creating the application, copy the Client ID and the Client Secret, and save them in a secure location.
   The Client ID and the Client Secret credentials are critical for OIDC communication and must be kept secure.
4. Assign at least one user and one admin to the application. These users must already exist in Lucidworks Platform. You must assign yourself as one of the users to be able to complete the authentication configuration.

​

Create the Identity Provider in Lucidworks Platform

1. Navigate to the megamenu and click Settings > Users & Provisioning > Authentication > OIDC.
2. Enter values in the required fields:
   • Email Domains: Enter the list of domains you want to use as filter options, for example, lucidworks.com.
     Be careful not to lock yourself out at this step in the process. If you list a domain that you already use to log into Lucidworks Platform, and you don’t complete the rest of the steps listed here, then you will be prompted to log in via SSO the next time you log out, which won’t work. If you are unable to log into Lucidworks Platform, contact Support or your Lucidworks representative.
   • Enter the Client ID and Client Secret provided by your identity provider’s OIDC application.
   • Enter the Configuration URL provided by your identity provider.
     To get the full OIDC configuration URL, append /.well-known/openid-configuration to your Issuer URL. For example, if your issuer is https://idp.example.com, the full configuration URL would be: https://idp.example.com/.well-known/openid-configuration
   • Enter the Issuer URL, which identifies your identity provider’s authorization server and is provided by your identity provider’s OIDC application.
   • Enter the Authorization URL for the server that performs user authorization.
   • Enter the Token URL for the server where the authorization code is sent to obtain a user access token.
   • Enter the User Info URL for the server where the user profile attributes are stored and can be retrieved after authentication.
   • Enter the JWKS URL, which is the JSON Web Key Set that verifies signed JWT tokens, provided by your identity provider’s OIDC application.
3. Click Save.
4. The Identity Provider process may take several minutes to complete. Once finished, the URLs for IDP Configuration display on the right side of the screen. Copy the Redirect URL and save it in a secure location.

​

Configure the redirect URI in your identity provider

1. In your identity provider, navigate to the application you created for Lucidworks SSO.
2. Add the Redirect URL generated by Lucidworks Platform to the application’s sign-in redirect URIs.
3. Save your changes.

​

Test SSO functionality

​

SAML authentication

​

Create users in Lucidworks Platform

1. Navigate to the megamenu and click Settings > Users & Provisioning > Users.
2. Verify all necessary users are listed, active, and their emails match their identity provider user counterparts.
3. If any users are missing, add the appropriate users by completing the steps in invite workspace owners.

​

Create a SAML application in your identity provider

1. Create a new SAML application in your identity provider. Refer to your provider’s documentation for detailed steps:
   • Okta
   • Microsoft Entra ID
   • Google Workspace
2. When creating the application, use the following settings:
   • Sign-in method: Select SAML 2.0.
   • Single Sign On URL (ACS URL): Enter a placeholder URL for now. You’ll configure it in a later step.
   • Audience URI (SP Entity ID): Enter a placeholder URL for now. You’ll configure it in a later step.
   • Name ID Format: Select the appropriate Name ID format. This is usually EmailAddress.
   • Application username: Choose how your identity provider should map the user’s application username. For example, their identity provider username or email address.
3. After creating the application, locate its metadata, copy the Metadata URL, and save it in a secure location.
   The Metadata URL is critical for SAML communication and must be kept secure.
4. Assign at least one user and one admin to the application. These users must already exist in Lucidworks Platform. You must assign yourself as one of the users to be able to complete the authentication configuration.

​

Create the Identity Provider in Lucidworks Platform

1. Navigate to the megamenu and click Settings > Users & Provisioning > Authentication > SAML.
2. Fill out required fields:
   • Email Domains: Enter the list of domains you want to filter by, for example, \lucidworks.com.
     Be careful not to lock yourself out at this step in the process. If you list a domain that you already use to log into Lucidworks Platform, and you don’t complete the rest of the steps listed here, then you will be prompted to log in via SSO the next time you log out, which won’t work. If you are unable to log into Lucidworks Platform, contact Support or your Lucidworks representative.
   • Enter the Metadata URL provided by your identity provider’s SAML application.
   • Enter the Issuer URL that specifies which identity provider is used by SAML. This value is generated when the SAML application is created.
   • Enter the Identity Provider SSO URL, which is the single sign-on endpoint for users, and is provided by your identity provider’s SAML application.
   • Paste the Certificate information, which is provided by your identity provider’s SAML application and is used by the identity provider to sign SAML responses.
3. Click Save.
4. The Identity Provider process may take several minutes to complete. Once finished, the URLs for IDP Configuration display on the right side of the screen:
   • Audience URI
   • Assertion Consumer Service URL
5. Copy the URLs and save them in a secure location.

​

Configure the application in your identity provider

1. In your identity provider, navigate to the application you created for Lucidworks SSO.
2. Update the application’s SAML settings:
   • In Single Sign On URL (ACS URL) paste the Assertion Consumer Service URL generated by Lucidworks Platform.
   • In Audience URI (SP Entity ID) paste the Audience URI generated by Lucidworks Platform.
3. Optional: If your identity provider supports SAML attribute mapping, configure the following mappings to send additional user information to Lucidworks Platform:

   	Name	Name Format	Value
   Email	email	Unspecified	user.email
   First Name	firstName	Unspecified	user.firstName
   Last Name	lastName	Unspecified	user.lastName
   Username	username	Unspecified	user.login

4. Save your changes.

​

Test SSO functionality