Add multiple single sign-on providers to Genesys Cloud
AI-generated summary
Genesys Cloud supports up to 30 SAML-based single sign-on (SSO) configurations with multiple identity providers through comprehensive metadata management and security features. The platform enables customizable login screens displaying up to six SSO providers directly on the interface, with additional options accessible via dropdown menu, and supports unique branding including SVG logos (maximum 25 KB) and custom display names.
SSO configuration requires administrator access through Admin > Integrations > Single Sign-on, with prerequisites including SSO provider permissions, admin role in the identity provider account, matching email addresses across systems, identity provider metadata, and an encoded public certificate. The system accommodates both identity provider-initiated and service provider-initiated authentication flows, with metadata exchange automatically populating required fields including Issuer URI, Single Sign-On URI, Single Sign-On Binding, Single Logout URI, Single Logout Binding, and Name Identifier Format.
Security features include digitally signed authentication requests, SAML assertion decryption, and X.509 certificate management supporting up to five certificates per SSO configuration. The platform processes case-sensitive SAML attributes to control access authorization, including AuthorizedClientIDs for granular application-level access control across standard and virtual desktop infrastructure (VDI) environments, and OrganizationName for multi-organization deployments using a single identity provider. The optional ServiceName parameter redirects authenticated users to specific destinations using valid URLs or predefined keywords.
The Single Sign-On page displays all integrations in list format with login names, logos, identity providers, and certificate expiration details, with sorting and filtering capabilities through an Action menu for edit and delete functions. Organizations can add new identity providers, download Genesys certificates for transmission to identity providers, and configure inactivity timeout behavior to redirect users either to the identity provider login or Genesys Cloud login using the ForceAuthn flag. Upon configuration save, Genesys Cloud generates SAML metadata containing the Issuer URI, Assertion Consumer Service, and Single Logout URI for identity provider configuration, with administrators able to download complete metadata files or individual certificates as needed.
Single Sign-on > Provider > Add, Delete, Edit, and View permissions
Admin role in your organization’s identity provider account
A single email address for both the identity provider account and Genesys Cloud
Metadata from your identity provider
An encoded public certificate from your identity provider
Genesys Cloud allows you to configure up to 30 single sign-on (SSO) integrations with the same identity provider or a mix of identity providers.To help you create your SSO integrations, Genesys Cloud enables you to import a Security Assertion Markup Language (SAML) metadata file that you receive from your identity provider. Importing a SAML metadata file, which contains the relevant configuration details and certificate information, automatically populates the necessary fields in the integration.
Important: Add Genesys Cloud as an application that organization members can access with their single sign-on provider account.
Single sign-on page
To track multiple SSO integrations, Genesys Cloud displays the integrations as a list on the Single Sign-On page. The page provides a summary of each integration including the log in name, logo, identity provider, and certificate expiration details. In the Action column, click More to display a menu that allows you to edit and delete an integration. On the Name, Identity Provider, and Certificate Expiration column headers, click Sort to rearrange the view in ascending or descending order.
The page also provides options that allow you to add an identity provider and download a Genesys certificate. To send a Genesys certificate to an identity provider, click Download Genesys Certificate.
Click the image to enlarge.
Customize the login screen for each SSO integration
You can customize how to display each SSO integration with a different login name and a logo of your choice. You can choose to display the name or the logo, or both the name and logo. The choice you make determines how the SSO integration displays on the Single Sign-On and Genesys Cloud login pages.
To conserve space, only six SSO integrations appear directly on the Genesys Cloud login page.
If you have more than six SSO integrations, they appear in a list on the login page.
Create an SSO integration
Genesys Cloud metadata
To pair an SSO integration between Genesys Cloud and an identity provider, configure settings on both ends. Identity providers supply you with a metadata file that contains the issuer URI, single sign-on URI, and single log out URI to enter into Genesys Cloud as you configure your organization’s identity provider account. You can generate a SAML metadata file with the Genesys Cloud metadata and certificate information that an identity provider must use to configure settings on their end.
To create an SSO integration:
Click Menu > IT and Integrations > Single Sign-on.
Click Add an Identity Provider.
Enter the name that you want to assign to your integration.
To display the logo on the Genesys Cloud login page, select Display Name On Login Page.
Note: If you have more than six identity providers, the Display Name On Login Page option is not available.
Click Identity Provider Name and you can select one of the available, fully supported, identity providers or enter a new identity provider name.
Note: The Identity Provider Name list contains a set of the most common providers. If you do not see your identity provider listed, you can add them by typing their name. After you save the configuration, the new identity provider appears in the list.
Click Select logo and upload the logo image file that you want to display on the login page. Alternatively, you can drag and drop the logo image file.
Note: The logo image file must be in SVG format and cannot be larger than 25 KB in size.
To import the metadata file that your identity provider sent to you, in the Identity Provider Data section, click Select SAML metadata to import. Alternatively, you can drag and drop the metadata file.
After you import the metadata file, notice that the required fields are automatically populated and the encoded public x509 certificate for SAML signature validation is available.
Field
Description
Issuer URI
The identity provider’s Issuer ID.
Single Sign-On URI
The identity provider’s Single Sign On URL.
Single Sign-On Binding
The sign in binding that your identity provider specified.
Sign Authentication Requests
Select the Sign Authentication Requests check box if you want to add an extra layer of security to verify that requests are coming from a verified source.
Note: As an additional security measure, Genesys Cloud enables you to sign authentication requests. A signed authentication request is a SAML (Security Assertion Markup Language) request that has been digitally signed to ensure its authenticity and integrity.
Single Logout URI
The log out URL that your identity provider specified.
Single Logout Binding
The log out binding that your identity provider specified. If no binding is specified, select HTTP Redirect.
Name Identifier Format
The format that your identity provider specified. If the format is unknown, select Unspecified.
Redirect to IdP with ForceAuthn flag on Inactivity Timeout
Use this check box to determine what happens when an inactivity timeout occurs.
Select the check box to redirect to the identity provider’s login. (Default)
Clear this check box to redirect to Genesys Cloud login.
Note: ForceAuthn (Force Authentication) is an optional attribute in a SAML authentication request sent from a Service Provider (SP) to an Identity Provider (IdP) that tells the IdP to force a user to re-authenticate, even if they have an existing active session.
Certificate
X.509 certificates for SAML signature validation. Uploaded certificates appear with their expiration date. You can have up to five certificates per SSO configuration. Genesys Cloud chooses the correct certificate during single sign-on and logs out.
To upload more certificates, click Select certificates to upload and upload the certificate. Alternatively, you can drag and drop the certificate.
To remove a certificate, click Remove
Click Save.
Genesys Cloud Service provider data
When you click Save, Genesys Cloud generates the SAML metadata that your identity provider uses when configuring your identity provider account.
Note: The generated metadata file includes the Issuer URI, the Assertion Consumer Service, and the Single Logout URI.
To download a SAML metadata file that contains the Genesys Cloud metadata and certificate information that an identity provider must use to configure settings on their end, under Genesys Cloud Metadata, click Download Metadata.
If you only need a Genesys certificate to send to an identity provider, under Single Logout URI, click Download Certificate.
SAML assertion decryption support
Genesys Cloud supports SAML assertion decryption for single sign-on. This feature is designed to provide your organization with an additional layer of security for SSO configurations. With this feature, identity providers can securely encrypt SAML assertions using the Genesys Cloud public encryption key, ensuring only authorized decryption. To enable SAML assertion decryption support, download the current Genesys Encryption certificate and send it to your identity provider.
Download the Genesys Encryption certificate from either the main Single Sign-On page or from your identity provider configuration page.
At the top of the Single Sign-On page, click Download Genesys Encryption certificate. At the bottom of your identity provider configuration page, click Download Genesys Encryption certificate.
SAML attributes
If the following extra SAML attributes are present in the assertion, Genesys Cloud acts on the attributes. The attributes are case-sensitive.
Attribute name
Attribute value
AuthorizedClientIDs
Used by an Identity Provider to enumerate the client IDs that the authenticated user is authorized to access. If an authenticated user attempts to access a client that is not included in the AuthorizedClientIDs list, instead of creating an access token for that client, the user redirects to the Identity Provider for extra verification.
When Genesys Cloud receives an authorization request:
If the user’s session includes authorization for the requested client, Genesys Cloud issues a token.
If the user’s session does not include authorization for the requested client, Genesys Cloud redirects the user to SSO for reauthentication and follows the standard flow.
This functionality allows the Identity Provider to determine which clients the authenticated user can access via the AuthorizedClientIDs SAML attribute. If an authenticated user attempts to access a client that is not included in the AuthorizedClientIDs list, then instead of creating an access token for that client, Genesys Cloud redirects the user back to the Identity Provider for more verification.
This attribute provides an additional layer of security by enabling organizations that use SSO to securely allow access to specific applications such as WebRTC Media Helper or Genesys Tempo, both within and outside virtual desktop infrastructure (VDI) environments, without reliance on the more restrictive Allowed IP Addresses feature.
The AuthorizedClientIDs for WebRTC Media Helper and Genesys Tempo are as follows:
WebRTC Media Helper client ID = “64cd7f8c-207b-4caf-b888-56b8e17384a6”
Genesys Tempo client ID for Android = “a726a4a8-9915-4966-9ac2-b8c9064fe30d”
Genesys Tempo client ID for iOS = “9fa531f6-e8a9-4f83-b6d6-12f66f7edb5e”
OrganizationName
For identity provider-initiated single sign-on: Use the organization short name.
For service provider-initiated single sign-on: Make sure that the organization name matches the organization name that you select. It is applicable when an organization maintains multiple Genesys Cloud organizations using a single identity provider.
ServiceName
(Optional) A valid URL for the browser to be redirected to after successful authentication, or one of the following keywords:
directory (redirects to the Genesys Cloud Collaborate client)
directory-admin (redirects to the Genesys Cloud Admin UI)