How to Configure SSO Support for Global Manager

Enabling SAML-Based SSO in ScienceLogic Global Manager

ScienceLogic Global Manager (GM) is a powerful appliance designed to aggregate and display data from multiple SL1 systems, providing a centralized view of your entire infrastructure. Starting with SL1 version 12.2.1, ScienceLogic introduced support for Security Assertion Markup-Language (SAML) based Single Sign-On (SSO), simplifying authentication and enhancing security.  

This guide, walks through the process of enabling SAML-based SSO in ScienceLogic Global Manager, so that user access can be managed seamlessly and improve operational efficiency.  

---

Why Enable SAML-Based SSO?

Enabling SSO through SAML allows users to log in once and gain access to multiple SL1 systems through the Global Manager providing the users are already authorized to access the target systems. This streamlines Identity and Access Management (IAM), reduces password fatigue, and strengthens the organization's security posture.

Getting Started:

Before beginning, ensure the following is true:

• SL1 Version: 12.2.1 or later
• Access Level: Administrator access to the Global Manager appliance.  

---

Prerequisites: 

• ScienceLogic assumes that the "SL1: Global Manager" PowerPack has been installed and the child stacks have been discovered.
• No platform version mismatch between the GM and the child SL1 Stacks
• AP2 version across all Stacks as a minimum must be Gelato v8.14.26
• The Child SL1 stacks are configured to authenticate using SSO authentication
• A local administrator account must exist on each Child Stack that GM can use to authenticate with the child stack.
• GM SSO authentication resource must be configured to authenticate with the same Identity Provider (IdP) configured on the Child SL1 stacks
• The ‘/opt/em7/nextui/nextui.conf’ file on the GM must have the following variable configured - If the GM platform is hosted by ScienceLogic a Service Request must be raised using the ScienceLogic Support Portal here to request an addition of the environmental variable:   

   

  GM_STACKS_CREDENTIAL=enabled
  GM_STACKS_CACHE_TTL_MS=0
  GM_SESSION_AUTH_CACHE_TTL_MS=0
  GLOBAL_MANAGER_SESSION_COOKIE_CACHE_TTL_MILLIS=0

• Unique SL1 Administrator accounts must exist on each child stack – These act as a global API key for users which allows authentication on the child stack. Once a user authenticated, the user data is loaded on to GM and the request proceeds as normal. 

---

Step 1: Configure Basic/Snippet Credentials

a) Access GM UI and logon using an Administrator Account

b) Navigate to Credentials page (Manage > Credentials) and Select ‘Create New’ followed by ‘Create Basic/Snippet Credential’. A dialog window will be presented, this must be completed with the details listed in the table below for each child stack using the Administrator Credentials to enable GM to authenticate with the child stacks

c) Perform Credential Test using the Credential Tester and confirm the authentication is successful.

---

Step 2: Credential Alignment - GraphQL

Following the creation of the Basic Credential, each child stack credential must be aligned using GraphQL (GQL) mutation – The command requires supplying the ‘guid’ of the credentials created above in step 2 above.

The following GQL will return all credentials created in Step 1 above providing the credential names contain ‘GM’.

Access the GQL Browser by appending /gql to the GM URL I.E. https://<GlobalManager_HOST>/gql - This will provide access to the GQL Browser.

Query:

query allCreds{
  credentials (search:{name:{contains:"GM"}}) {
    edges {
      node {
        id
        guid
        name
        definition
      }
    }
  }
}

Example Response:

The example response shows the required ‘guid’ - Ensure a note of each ‘guid’ associated with each credential is noted for Step 4.

{
  "data": {
    "credentials": {
      "edges": [
        {
          "node": {
            "id": "41",
            "guid": "3C07AB8B0655A722712C46FA1DF821EA",
            "name": "stack_1_gm_auth",
            "definition": 
            [..]
          }
        }
      ]
    }
  }
}

---

Step 3: Retrieve GM Stack ID

The following GQL will return all existing Child SL1 Stacks present on the GM.

Query:

query getallstacks {
  globalManagerStacks {
    edges {
      node {
        id
        name
        credential {
          guid
          name
        }
      }
    }
  }
}

Example Response:

Note the ‘id’ representing the GM Stack-ID’s for the next step.

{
  "data": {
    "globalManagerStacks": {
      "edges": [
[..]
      {
          "node": {
            "id": "3",
            "name": "<sl1_stack_hostname>",
            "credential": null
          }
        }
[..]
}

---

Step 4: GraphQL Credential Mutation

The following GQL mutation will align the Basic Credential to permit GM to authenticate with the target child stacks.

Mutation:

mutation aligncred {
  alignGlobalManagerCredential(id: <Stack-ID>, credential: "<guid>") {
    id
    name
    credential {
      id
      name
      guid
    }
  }
}

Replace:

• with the GM Stack-ID for each child stack retrieved from Step 3.
• with the credential GUID from Step 2 that is associated with the same Child Stack.

Example Mutation Response:

{
  "data": {
    "alignGlobalManagerCredential": {
      "id": "3",
      "name": "<child_stack_name>",
      "credential": {
        "id": "41",
        "name": "stack_1_gm_auth",
        "guid": "3C07AB8B0655A722712C46FA1DF821EA"
      }
    }
  }
}

Repeat the above mutation for the remaining Child SL1 stacks discovered on GM.

---

Summary 

Enabling SAML-based SSO in ScienceLogic Global Manager streamlines authentication, enhances security, and improves operational efficiency by allowing users to seamlessly access multiple SL1 stacks with a single login. By following the outlined steps — configuring credentials, aligning them via GraphQL, and ensuring proper authentication setup —organizations can integrate SSO effectively while maintaining secure access controls.  

After completing these steps, users will be able to log in once and have visibility of managed devices across multiple SL1 stacks via GM, enhancing productivity and reducing security risks.  

By leveraging SAML-based SSO, ScienceLogic not only simplifies access but also strengthens the overall security posture. If there are issues encountered, please contact ScienceLogic Support here.

For further details related to GM setup, refer to the official ScienceLogic documentation here.