Skip to content
Wasp InventoryWasp Inventory Help

Single Sign-On (SSO)

Single Sign-On (SSO) lets your users sign in to Wasp Inventory through your organization’s own identity provider (IdP) instead of a separate Wasp Inventory password. Wasp Inventory supports two methods: ADFS (WS-Federation) and SAML 2.0.

Before you begin

Section titled “Before you begin”
  • SSO is set up by an administrator under the Settings gear, gated by your role’s permissions. See Roles & permissions.
  • The Single Sign On section only appears if single sign-on is enabled for your organization’s account. If you don’t see it, contact Wasp about enabling it.
  • Set up outgoing email first. SSO validation is blocked until SMTP is configured.
  • Each person who signs in with SSO still needs an active Wasp Inventory user account: SSO handles sign-in, it doesn’t create accounts on its own. See Managing users.
  • Have your identity provider’s details ready (metadata URL for ADFS; sign-in URL and signing certificate for SAML).

Choose a login option

Section titled “Choose a login option”

Open Settings gear → Single Sign On, and set Login Option to one of:

  • WaspCloud — the default; users sign in with their Wasp Inventory username and password (SSO off).
  • Federated (ADFS) — sign in through an AD FS server.
  • SAML — sign in through any SAML 2.0 identity provider.

Choosing ADFS or SAML shows the fields for that method.

Set up ADFS

Section titled “Set up ADFS”

Provide your AD FS Metadata URL. If Wasp Inventory can’t validate the certificate chain for that endpoint, tick Ignore Chain Errors and supply the certificate Thumbprint.

Set up SAML

Section titled “Set up SAML”

Wasp Inventory shows two read-only values, an SSO URL (the address the IdP posts back to) and an Entity Id, that you give to your SAML identity provider when you register Wasp Inventory as an application there.

Then provide your IdP’s details in Wasp Inventory:

  • SAML Url — your identity provider’s sign-in URL.
  • Certificate — your identity provider’s X.509 signing certificate.
  • Validate Signature and Include AuthnContext — optional security settings.

To save typing, you can upload your IdP’s metadata XML (or point Wasp Inventory at its metadata URL) to auto-fill the SAML Url and Certificate, then adjust anything by hand.

Validate and save

Section titled “Validate and save”

Click Validate for the method you chose. Wasp Inventory sends you through your identity provider’s real sign-in, then checks that it comes back with a matching email and role for your own account. On success, the configuration is marked valid; click Save to store it. If validation fails, the page explains why (for example, a mismatched email, a role/group that doesn’t match, an invalid certificate or URL, or that cookies must be enabled).

How users sign in afterward

Section titled “How users sign in afterward”

Once SSO is set up and active, the sign-in page sends users to your identity provider automatically; they authenticate there and are returned to Wasp Inventory. Wasp Inventory matches them to an existing user account by email address, so:

  • The person must already have an active Wasp Inventory account with a matching email. See Managing users.
  • Their identity provider group must match their Wasp Inventory role name.

Troubleshooting

Section titled “Troubleshooting”
  • I don’t see the Single Sign On section. It only appears when SSO is enabled for your organization. Contact Wasp about enabling it.
  • The Validate button is disabled. Configure and validate your outgoing email (SMTP) first.
  • A user gets “user has not been registered.” No active Wasp Inventory account matches the email their identity provider returned. Add the user under Managing users first.
  • A user is rejected for their group/role. The group their identity provider sends must match a Wasp Inventory role name. Align the names under Roles & permissions and try again.
Section titled “Related”