Single sign on - SSO

The old TDS SSO featured based on CAS technology has been replaced by a new with support of OpenID Connect and SAML.

Thanks to the implementation of the new TDS SSO, TDS Saas Service can now be integrated with customer´s Active Directory and authentication of users using OAuth 2.0 protocols.

Key SSO Keycloak features:

1. One time password policy
   1. User logins to TDS SSO and is allowed to access all his available TDS services
   2. User logout from TDS SSO and is logout from all his TDS services which support SSO logout
   3. SPNEGO - disabled
2. Centralized password policy
   1. User accounts are managed using a single centralized service
3. Identity brokering
   1. Identity providers based for example on:
      1. OpenID Connect v1.0
      2. SAML v2.0
      3. OAuth v2.0
4. Authorization policy
   1. Realm role level
   2. Client roles
   3. Role-based access control

SSO Session

TDS Login Page

There are the following items on TDS Login Page:

• Username
  • user TDS account id required to log in to TDS service
• Password
  • user account password
• Remember Me
  • allow user to remain logged in between browser restarts until session expires
• Create new account
  • link to Create New Account page
• Contact support
  • link to TDS support page Help/Feeedback
• Reset password (only for TDS instances without AD integration)
  • link to TDS reset password page Reset password

Create New Account

Self-invitation is not possible in public TDS.

When it's requested, it's possible to configure TDS portal to support self-invitation:

After entering proper e-mail address, invitation is sent to a new user. A new user is added after email confirmation to TDS portal only (not to Company/Project).