# SSO Configuration

In addition to local users, In-Sight vision systems also support Single Sign-On (SSO) using Active Directory with Lightweight Directory Access Protocol (LDAP) or Lightweight Directory Access Protocol Secure (LDAPS). The SSO Configuration tab of the User Settings utility allows you to connect the vision system to a domain controller that authenticates users, and map LDAP user groups to access levels in In-Sight Vision Suite.

## Prerequisites

Before configuring SSO settings, make sure that the vision system fulfills the following requirements:

- A DNS server is defined in the Network Settings utility.

- Time synchronization is configured in the Time Settings utility.

- The password for the admin user is not blank.

If the vision system does not fulfill these requirements, the SSO Configuration tab of the User Settings utility is disabled.

You must also have an existing Active Directory authentication service with defined user roles that you can map to access levels in In-Sight Vision Suite.

If In-Sight Vision Suite does not find the user in the SSO server, it attempts to log the user in as a local user.

## Connection Settings

Configure the SSO connection settings for the vision system in the Connection Settings section of the tab using the following parameters:

Parameter | Description
--- | ---
Transport | The authentication protocol used by the Active Directory service.
DNS Server | The DNS server for the Active Directory service. Note: You cannot edit the DNS server in the User Settings utility. To configure the DNS server, use the Network Settings utility.
Domain Controller | The domain controller for the Active Directory service.
Domain Name | The name of the domain where the Active Directory server is connected.
CA Certificate | You can upload a CA certificate or delete an existing one. The details of the certificate are displayed in the Certificate Details section. Supported certification formats: .cer extension Base64 encoding X.509 format Note: This setting is only available if the Transport parameter is set to LDAPS.
Test Connection | Click Test Connection to verify your SSO network settings using your Active Directory user name and password.

To save your changes, click Apply in the bottom right corner of the window.

## Group Mappings

Map the LDAP user groups to access levels in In-Sight Vision Suite in the Group Mappings section of the tab.

Note: If a user is a member of multiple user groups with conflicting access levels, In-Sight Vision Suite returns an error when the user attempts to log in.

1. Click Add to create a new group mapping entry.

2. Enter the LDAP user group name in the Active Directory Group field using the Distinguished Name syntax. For more information about Distinguished Names, refer to the Microsoft help page.

3. Define the In-Sight access level for the user group using the Access Level dropdown. For more information about access levels, see User Access Levels.

Note: In-Sight Vision Suite does not support nested Active Directory group membership.

To remove a group mapping, select the entry and click Delete.

To save your changes, click Apply in the bottom right corner of the window.

## Import and Export

You can export the SSO settings of a vision system and import the saved settings in another vision system to simplify the configuration process for multiple vision systems.

1. Open the User Settings utility for the vision system from which you want to export the SSO settings.

2. Click Export in the bottom left corner of the window. When you click Export, the SSO settings for your vision system are saved to your clipboard.

   Note: When you export SSO settings with LDAPS transport selected, the certificate file path is only populated if you selected the certificate file from your local system during your current session with the SSO Configuration utility.

3. Open the User Settings utility for the vision system to which you want to import the SSO settings.

4. Click Import in the bottom left corner of the window. Click Apply to finalize the change.

   Note: You can only import SSO settings from another vision system if you have the settings copied in your clipboard. You can copy the exported settings to a text file if you need to save the settings externally.

## Troubleshooting

If you receive an error when attempting to sign in, investigate the following potential causes:

- Authentication Failure

  In-Sight Vision Suite was not able to authenticate the provided credentials with the Active Directory server.

  - Verify that the provided credentials are correct. If the credentials are correct, it is possible that the vision system is unable to reach the Active Directory server.

  - Verify your SSO settings and click Test Connection to make sure that the vision system can establish a connection.
  - If you are using LDAPS transport, verify that the provided certificate is valid and not expired.

- Insufficient Permissions

  The user does not have the correct permissions to access the vision system.

  - Verify that the provided credentials have the correct access levels.

  - Verify that the user is part of an Active Directory group that is configured in the In-Sight SSO group mappings.

  - Check the spelling of the Active Directory group in the SSO group mappings, and make sure that it conforms to the Distinguished Name syntax.

  - Verify that the user is not part of multiple groups with conflicting user access levels.

If you receive an error while configuring SSO settings, make sure that you are making changes using a local user. If you are logged in with SSO credentials, changing SSO settings can revoke your access, and all further commands fail.

If you are experiencing issues with Active directory groups, make sure that they are not in conflict with Cognex SSO restrictions. Cognex SSO supports generic Active Directory user and group accounts with the following exceptions:

- Cognex SSO does not support full principal names for user names, as In-Sight Vision Suite automatically adds the domain name to the user name.

- Cognex SSO does not support nested Active Directory group membership.
- Cognex SSO does not support users with multiple group memberships.

- Cognex SSO only supports user names that use uppercase and lowercase letters from A to Z, numbers, and underscores. All other characters are invalid in user names.

- There are no character restrictions for passwords.