Site Search > Account Menu > My Profile

SearchStax Site Search solution offers several ways to increase the security of your search application:

• Change Password – see how to change your Site Search password
• Two-Factor Authentication (2FA) – increase security with Two-Factor Authentication
• Single Sign-On (SSO) – learn more about Single Sign-On for Site Search
  • Single Sign-On – Okta
  • Single Sign-On – OneLogin
  • Single Sign-On – PingFederate
  • Single Sign-On – Azure AD

The post Security Overview appeared first on SearchStax Docs.

Site Search > Account Menu > My Profile

There are multiple ways to change a password in the SearchStax Site Search solution depending on context.

If you are locked out of your SearchStax account, use the Forgot Password link on the login page.

If you should need to change your own password because it is about to expire, pull down the Accounts menu in the upper-right corner of the Site Search and select My Profile. 

On the My Profile screen, you can edit the user’s first and last names, and you can view the associated email address. One cannot change the email address, since that is the SearchStax user’s unique ID. (Changing the email requires the assistance of the SearchStax Support Desk.)

To change the password, click the Edit Credentials button.

The post Change Your Password appeared first on SearchStax Docs.

Site Search > Account Menu > My Profile

All SearchStax Site Search solution users have the option of enabling Two-Factor Authentication (TFA) using the Google Authenticator. Pull down the Accounts menu in the upper-right corner of the Site Search and select My Profile. 

If you scroll down to the lower part of the My Profile screen, Site Search offers you the option of using Two-Factor Authentication.

The setup procedure is simple. Click the Set Up Google Authenticator button to generate the QR code on this screen:

Install the Google Authenticator app on your phone or tablet and use it to scan the QR code. Once the link to SearchStax is verified (which is almost instantaneous), the phone app begins to display six-digit numbers.

When you log into SearchStax, enter your email address and strong password as usual. SearchStax will open a field for your six-digit code. This code changes once each minute, so it is a very secure way to authenticate.

Note that Site Search displays a screen of one-time Backup Verification Codes that you can use if you lose your phone. We recommend that you store these codes in a safe place.

It is possible to disable Two-Factor Authentication from this same Profile screen, should you need to do so.

The post Two-Factor Authentication appeared first on SearchStax Docs.

Site Search > Account Menu > My Profile

The SearchStax Site Search solution now offers the ability for clients to set up Single Sign-On (SSO) using the Security Assertion Markup Language (SAML), which is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP).

SSO is an add-on Site Search feature that needs to be purchased. If you are interested in this feature, please contact us here. The SSO features of the Site Search will not appear until we have authorized the feature in your account.

Pull down the Accounts menu in the upper-right corner of Site Search and select My Profile. 

If you scroll down to the lower part of the My Profile screen, the Site Search offers you the option of using Single Sign-On.

Click the button to view a page of SSO setup fields. The procedure for setting up this feature is the same as that on this Managed Search page.

Login Using SSO

https://searchstudio.searchstax.com/ now provides a button at the bottom for SSO – “Sign-In using your ID Provider.” Click this button.

Enter the domain that was set up for the client.

Click Continue. This takes you to your Azure Sign-in page. After you authenticate, it brings you back to Site Search.

Alternately, you can directly go to https://<Subdomain>.searchstax.com to login, and clicking on the “Sign-In With your ID Provider” will take you directly to Azure Sign In.

SSO + Two-factor Authentication

A User can have SSO and Two-Factor authentication both set up. The 2FA settings for a user will apply to all accounts that the user has access to.

However, for the account that has SSO Setup, while logging in, SearchStax 2FA settings will not apply. In that case, 2FA should be set up at the SSO Provider.

The post Single Sign-On appeared first on SearchStax Docs.

The SearchStax Site Search solution now offers the ability for customers to set up Single Sign-On (SSO) to let their users log into SearchStax apps with a single ID and password that works across multiple software systems.

We use the open standard Security Assertion Markup Language (SAML) to allow identity providers (IdP) to pass authorization credentials to service providers (SP). This page provides instruction to use Okta to implement SSO for SearchStax.

SSO is an add-on SearchStax feature that is purchased separately. If you are interested in SSO, please contact Sales or your Account Manager.

Once SSO is enabled for your account and a domain is set up, the admin is able to see the configuration options in the User Preferences screen of the Site Search Dashboard.

The following steps explain how it can be set up for Okta.

Instructions

Once SSO is enabled by SearchStax for your account, and a domain is set up, the options to set up SSO appear in the My Profile screen of the My Account menu:

The Set Up Single Sign-On button leads to a screen of configuration URLs and feature options. You will need to refer to this screen while setting up the SSO profile with the Identity Provider.

This screen contains the following fields and options:

• Assertion Consumer Service (ACS) URL: Note that the URL includes your SSO domain (called mydomain in the following discussion).
• Metadata URL: SearchStax metadata endpoint.
• Enable Checkbox: If checked, SSO is enabled for this account.
• Assertion Responses Signed: Use the droplist to indicate whether assertions and/or responses should be signed.
• Allow Email Password Login Checkbox: If check, permits login by email/password in addition to SSO.
• Auto Create Users Checkbox: Should a new user account be created the first time a user logs in?
• IDP Entry URL: Identity provider URL.
• Metadata URL: The SAML 2 Metadata URL.
• Sign-In URL: The URL used for signing into the SAMP Identity Provider.
• Sign-Out URL (Optional): The URL shown after a successful sign-out.

Okta Setup

1. You need to be an Admin in Okta to set up the SearchStax Application.

2. Go to the Okta Admin Console. Click on Applications > “Create App Integration”. Select “SAML 2.0” and click on “Next”

3. Enter the name of the App as “SearchStax Studio” and click on Next

4. Configure the SAML Settings with the following information:

• Set the “Single sign on URL” as the Assertion Consumer Service URL provided in Site Search
• Check on “Use this for Recipient URL and Destination URL”
• Set the “Audience URI”as the Metadata URL provided in Site Search
• Set the “Name ID format” as “Unspecified”
• Set the “Application username” as “Email”
• Set the “Update application username on” as “Create and update”

5. Click on “Show Advanced Settings” and set “Response” and “Assertion Signature” to “Signed”. Below is a sample of Advanced Settings

*If you change the response and assertion settings, you will need to also change the Site Search “Assertions responses signed*” setting to match.

6. The next section provides Attribute Statements for mapping Okta fields to SearchStax. Below are sample mappings that we defined

The above example assigns the role of “Admin” to all users in Site Search. However, if you have a different field in Okta that maps the role, you can assign that field instead.

Click on Next.

7. Select “I’m an Okta customer adding an internal app” and click on “Finish”

8. Now click on the “View SAML setup instructions” button that is displayed to the right

9. Copy the “Identity Provider Single Sign-On URL” from the screen and set it as the Login url in Site Search.

10. Copy the “Identity Provider Issuer” from the screen and set it as the Idp entity url in Site Search.

11. Copy the XML shown in the Optional section with the title “Provide the following IDP metadata to your SP Provider” and host it on a URL (optionally, you can send it to us and we can host this for you). Copy this hosted IDP metadata URL and set it as the Metadata url in Site Search.

12. Now, set SSO to “Enabled”.

When you are testing, also check “Allow email password login” (You can turn this off once SSO testing is complete). Here is our example setting page:

Login Using SSO

On https://searchstudio.searchstax.com/ , click the “Sign-In using your ID provider” button.

Enter the domain.

Click Continue. This takes you to the Okta Sign-in page. After you authenticate, it brings you back to your SearchStax Site Search Dashboard.

SSO + Two-factor Authentication

A User can have SSO and Two-Factor authentication both setup. The 2FA settings for a user will apply to all accounts that the user has access to.

However, for the account that has SSO Setup, while logging in, SearchStax 2FA settings will not apply. In that case, 2FA should be set up at the SSO Provider.

The post Single Sign-On – Okta appeared first on SearchStax Docs.

The SearchStax Site Search solution now offers the ability for customers to set up OneLogin Single Sign-On (SSO) to let their users log in with a single ID and password that works across multiple software systems.

We use the open standard Security Assertion Markup Language (SAML) to allow identity providers (IdP) to pass authorization credentials to service providers (SP). This page provides instruction to use OneLogin to implement SSO for SearchStax.

SSO is an add-on Site Search feature that is available with the Advanced and Premium plans.

Instructions

Once SSO is enabled by SearchStax for your account, and a domain is set up, the options to set up SSO appear in the My Profile screen of the My Account menu:

The Set Up Single Sign-On button leads to a screen of configuration URLs and feature options. You will need to refer to this screen while setting up the SSO profile with the Identity Provider.

This screen contains the following fields and options:

• Assertion Consumer Service (ACS) URL: Note that the URL includes your SSO domain (called mydomain in the following discussion).
• Metadata URL: SearchStax metadata endpoint.
• Enable Checkbox: If checked, SSO is enabled for this account.
• Assertion Responses Signed: Use the droplist to indicate whether assertions and/or responses should be signed.
• Allow Email Password Login Checkbox: If check, permits login by email/password in addition to SSO.
• Auto Create Users Checkbox: Should a new user account be created the first time a user logs in?
• IDP Entry URL: Identity provider URL.
• Metadata URL: The SAML 2 Metadata URL.
• Sign-In URL: The URL used for signing into the SAMP Identity Provider.
• Sign-Out URL (Optional): The URL shown after a successful sign-out.

OneLogin Setup

1. Go to OneLogin administration dashboard and select the Applications drop down. Select Add App in the top right corner:
   
2. Now Search for “SAML Custom Connector (Advanced)” and then select the application:
   
3. Enter a display name for the custom SearchStax application – something like “SearchStax”. Feel free to customize the icon as well then click Save in the top right corner:
   
4. This creates a new Application in your user dashboard. Now go back to the applications tab still inside the administration dashboard and select your newly created application. You will see some new tabs on the left. Select the Configuration Tab:
   
5. This tab is where you will configure the SSO application with the information provided in our SearchStax dashboard. Since we used “mycompany” as our subdomain we will continue to use that here as well. Enter the provided metadata URL in the Audience (EntityID) box
   
   
6. Enter the provided ACS URLs into the Recipient, ACS Validator, and ACS URL boxes:
   
7. Enter the Login URL into the Login URL Box:
   
8. Be sure your settings align with what is shown below. This will be SP initiated, with a Persistent nameID, and both the assertion and response will be signed, then click Save in the top right:
   
9. Select the Parameters tab on the left. We expect Email, First Name, and Last Name to be passed so your parameters should look like the box below. You also have the ability to pass a “role” parameter. If you do not have a mapping for SearchStax roles, you can leave it as it, and the users will get created with Team Member as the role by default. These roles can always be changed later from the Managed Search Dashboard:
   
   
10. Next click into the SSO tab on the left. Take note of the Issuer URL and the SAML 2.0 Endpoint.
    
    You will be putting these values in the Managed Search dashboard as shown below. Click Save Settings when finished:
    
    

The steps below show how we have integrated it with our OneLogin instance.

Login Using SSO

The Site Search sign-in screen provides a button at the bottom for SSO – “Sign-In With your ID Provider.” Click this button.

Enter the domain that was set up for the client.

Click Continue. This takes you to the OneLogin Sign-in page. After you authenticate, it brings you back to your Site Search Dashboard.

Alternately, you can directly go to https://<Subdomain>.searchstax.com to login, and clicking on the “Sign-In With your ID Provider” will take you directly to OneLogin.

SSO + Two-factor Authentication

A User can have SSO and Two-Factor authentication both set up. The 2FA settings for a user will apply to all accounts that the user has access to.

However, for the account that has SSO Setup, SearchStax 2FA settings will not apply. In that case, 2FA should be set up at the SSO Provider.

The post Single Sign-On – OneLogin appeared first on SearchStax Docs.

The SearchStax Site Search solution now offers the ability for customers to set up PingFederate Single Sign-On (SSO) to let their users log in with a single ID and password that works across multiple software systems.

We use the open standard Security Assertion Markup Language (SAML) to allow identity providers (IdP) to pass authorization credentials to service providers (SP). This page provides instruction to use PingFederate to implement SSO for SearchStax.

SSO is an add-on Site Search feature that is available with the Advanced and Premium plans.

Instructions

Once SSO is enabled by SearchStax for your account, and a domain is set up, the options to set up SSO appear in the My Profile screen of the My Account menu:

The Set Up Single Sign-On button leads to a screen of configuration URLs and feature options. You will need to refer to this screen while setting up the SSO profile with the Identity Provider.

This screen contains the following fields and options:

• Assertion Consumer Service (ACS) URL: Note that the URL includes your SSO domain (called mydomain in the following discussion).
• Metadata URL: SearchStax metadata endpoint.
• Enable Checkbox: If checked, SSO is enabled for this account.
• Assertion Responses Signed: Use the droplist to indicate whether assertions and/or responses should be signed.
• Allow Email Password Login Checkbox: If check, permits login by email/password in addition to SSO.
• Auto Create Users Checkbox: Should a new user account be created the first time a user logs in?
• IDP Entry URL: Identity provider URL.
• Metadata URL: The SAML 2 Metadata URL.
• Sign-In URL: The URL used for signing into the SAMP Identity Provider.
• Sign-Out URL (Optional): The URL shown after a successful sign-out.

PingFederate Setup

Note: Make sure you have an Adapter already set up inside PingFederate!

1. Go to PingFederate IdP administration console and select the Create New button underneath the SP Connections section:
   
2. In the Connection Type tab select the Browser SSO Profiles/SAML 2.0 Template then click Next. In the Connection Options continue with Browser SSO and hit Next again:
   
3. The next tab is the Import Metadata tab. You can choose to extract our metadata from the URL (shown in a screenshot above the instructions) in our dashboard and import it here, this will prefill some future sections for you:
   
4. In the General Info tab you will need to ensure that the following boxes have the correct information in them whether you imported our metadata or not.
   
   The Entity ID box should contain our EntityID which is also our metadata URL.
   
   Connection Name is whatever you want to use to identify this connection in your PingFed dashboard.
   
   Virtual Server IDS is important because it will overwrite your “master” EntityID and display a value in your metadata that we require to connect properly. This will also need to be in a URL format so something like https://sso-t.com/idp/SSO.saml2 is recommended.
   
   After this scroll to the bottom and click next
   
   
5. The next tab is where you will configure the Browser SSO settings. After clicking configure Browser SSO select SP-Initiated SSO and hit Next.
   
   We left the Assertion Lifetime settings as default and then hit next again.
   
   
6. Next we need to configure the Assertion Creation by clicking the Configure Assertion Creation button. Keep standard identity mapping and hit Next. In the Attribute Contract tab you will need to pass surname, email, and givenName in the assertion via the Extend the Contract sections and then hit Next.
   
   
7. Now that the attributes are created they need to be mapped. This is done with the Map New Adapter Instance button on the Authentication Source Mapping tab.
   
   Here you will select the Adapter you have configured for this connection and then hit Next until you come to the Attribute Contract Fulfillment tab.
   
   Here you will map your values to the email, surname, and givenName attributes being passed from your end, when finished hit Next and then the Done button until you see the Configure Protocol Settings button.
   
   
   
8. When configuring the protocol you will want to send your POST requests to the ACS URL provided in our SearchStax dashboard.
   
   It will look something like this *.searchstax.com/saml2/acs/ then hit Next until you arrive at the Signature Policy Tab.
   
   Here you will select the Always Sign the SAML Assertion box. Now hit Next again until you get to the Configure Credentials button.
   
   
   
9. Here you are selecting the valid certificate used in your signings:
   
   
   Now hit Next and review all the tabs that are presented. If everything looks good you can activate the connection and then hit Save.
   
   
10. When you are finished settings things up in PingFed you will need to come back to our dashboard and input the values of your SSO:
    
    
    We need your IdP Entity URL, as discussed above this will be your VSID that you configured specifically for this connection.
    The URL to your metadata.
    Then finally the Login URL used for this connection.
    Once the above is added you can select the Enabled box and hit Save Settings.
    
    

Login Using SSO

The Site Search sign-in screen provides a button at the bottom for SSO – “Sign-In With your ID Provider.” Click this button.

Enter the domain that was set up for the client.

Click Continue. This takes you to the PingFederate Sign-in page. After you authenticate, it brings you back to your Site Search Dashboard.

Alternately, you can directly go to https://<Subdomain>.searchstax.com to login, and clicking on the “Sign-In With your ID Provider” will take you directly to PingFederate.

SSO + Two-factor Authentication

A User can have SSO and Two-Factor authentication both set up. The 2FA settings for a user will apply to all accounts that the user has access to.

However, for the account that has SSO Setup, SearchStax 2FA settings will not apply. In that case, 2FA should be set up at the SSO Provider.

The post Single Sign-On – PingFederate appeared first on SearchStax Docs.

The SearchStax Site Search solution now offers the ability for customers to set up Azure AD Single Sign-On (SSO) to let their users log in with a single ID and password that works across multiple software systems.

We use the open standard Security Assertion Markup Language (SAML) to allow identity providers (IdP) to pass authorization credentials to service providers (SP). This page provides instruction to use Azure AD to implement SSO for SearchStax.

SSO is an add-on Site Search feature that is available with the Advanced and Premium plans.

Instructions

Once SSO is enabled by SearchStax for your account, and a domain is set up, the options to set up SSO appear in the My Profile screen of the My Account menu:

The Set Up Single Sign-On button leads to a screen of configuration URLs and feature options. You will need to refer to this screen while setting up the SSO profile with the Identity Provider.

This screen contains the following fields and options:

• Assertion Consumer Service (ACS) URL: Note that the URL includes your SSO domain (called mydomain in the following discussion).
• Metadata URL: SearchStax metadata endpoint.
• Enable Checkbox: If checked, SSO is enabled for this account.
• Assertion Responses Signed: Use the droplist to indicate whether assertions and/or responses should be signed.
• Allow Email Password Login Checkbox: If check, permits login by email/password in addition to SSO.
• Auto Create Users Checkbox: Should a new user account be created the first time a user logs in?
• IDP Entry URL: Identity provider URL.
• Metadata URL: The SAML 2 Metadata URL.
• Sign-In URL: The URL used for signing into the SAMP Identity Provider.
• Sign-Out URL (Optional): The URL shown after a successful sign-out.

Azure AD Setup

1. Go to Azure Active Directory. Select Enterprise Applications, and then click on “New Application.”
2. Now Click on “Create your own application.”
3. Enter a name for SearchStax application – say “SearchStaxManagedSolr”, and select the last dropdown “Integrate any application you don’t find in the gallery” and then click on the “Create” button.
4. This creates a new Enterprise Application. In the screen that appears, click on the link for Step 1 > Assign Users and Groups. Here you can assign which Users/Groups have permission to SearchStaxManagedSolr Enterprise Application.
5. Click on “Add user/group” and then follow up to add all the users of groups that you would like to grant access to.
6. Once you are done with Step 1, click on the “Get started” link for Step 2. Setup single sign on.
7. Now select the single sign-on method as “SAML.”
8. It now shows the screen to configure the SAML endpoints:
9. Click on Edit on Step 3, and change Signing Option as “Sign SAML assertion” and click “Save.” The option can be anything else too, but the same setting should then also be chosen in the Managed Search Dashboard in the SSO settings.
10. Click on Edit button for Step 1 > Basic SAML Configuration.
    1. Enter the “Metadata URL” that shows on your https://app.searchstax.com/admin/sso/configure/saml2/ page as Identifier (Entity ID). Remove any extra entries and make sure the “default” checkbox is checked.
    2. Enter the Assertion Consumer Service URL as the “Reply URL” as shown below.
    3. Click “Save.”
11. Set up Step 2 > User Attributes & Claims. Click on Edit.
12. Managed Search has roles defined. If your active directory has a field containing a mapping for those roles, click on “Add new claim” and assign “role”. If you do not have a mapping for Managed Search roles, you can leave it as it, and the users will get created with Team Member as the role by default. Those can always be changed later from the Managed Search Dashboard.
    
    As just an example, we are mapping user.jobtitle field as the “role” as shown below.
    
    The Unique User Identifier (Name ID) should be mapped to your active directory field that is the email for the users that will use Managed Search. In our case, the default user.userprincipalname contained the information.
13. Now back on the Managed Search dashboard…
    1. Set the “Metadata url” as the “App Federation Metadata Url” shown in Step 3.
    2. Set the “Login Url” as the “Login URL” shown in Step 4.
    3. Set the “Logout Url” as the “Logout URL” shown in Step 4.
    4. Set the “Idp Entity Url” as the “Azure AD Identifier” shown in Step 4.

Login Using SSO

The Site Search sign-in screen provides a button at the bottom for SSO – “Sign-In With your ID Provider.” Click this button.

Enter the domain that was set up for the client.

Click Continue. This takes you to the Azure AD Sign-in page. After you authenticate, it brings you back to your Site Search Dashboard.

Alternately, you can directly go to https://<Subdomain>.searchstax.com to login, and clicking on the “Sign-In With your ID Provider” will take you directly to Azure AD.

SSO + Two-factor Authentication

A User can have SSO and Two-Factor authentication both set up. The 2FA settings for a user will apply to all accounts that the user has access to.

However, for the account that has SSO Setup, SearchStax 2FA settings will not apply. In that case, 2FA should be set up at the SSO Provider.

The post Single Sign-On – Azure AD appeared first on SearchStax Docs.