Jul 27, 2022 2:55:52 PM

Cirrus Discovery Documentation

Overview

Cirrus Identity’s Discovery product allows users to login via InCommon or EduGAIN, customer-specific identity providers (idPs) or social logins via the Cirrus Gateway.

Discovery is integrated with InCommon and the trust federations of eduGAIN. This gives customers access to this global metadata resource though an easy to use interface. In addition to these globally defined identity providers, Cirrus can configure IdPs that are customer specific. This allows customers to mix published and unpublished IdPs. These customer specific IdPs can include the Cirrus External Identity Provider. Finally, Discovery is integrated with Cirrus Gateway giving it the capability to also add social identity providers such as Google, Facebook, Microsoft, LinkedIn, or others as peers to traditional IdPs.

Discovery is also fully integrated with other Cirrus Modules, and is configured using the Cirrus Console. Discovery uses the global UI configuration customers establish for their brand and is responsive so it will display equally well on the desktop and on mobile devices. The configuration established for Discovery is carried over to the claim interface for Cirrus Invitation and request based Cirrus Account Linking. The same configuration is also leveraged for Cirrus Self-Registration.

Planning Steps

Step 1 - Determine your audience

The first planning step for Cirrus Discovery is to determine the audience and which identity providers that audience will need:

Will the audience primarily use social login options provided by Cirrus Gateway (Google, Facebook, Microsoft, LinkedIn, or others)?
Will the audience use the Cirrus OrgBrandedID?
Will the audience use the organization’s primary/enterprise Identity Provider?
Will the audience use other organization Identity Providers?
Will the audience use Identity Providers from InCommon or other eduGain federations?

The answers to these questions will influence the style of Discovery you choose.

Step 2 - Determine the desired end user experience

The second planning step is to determine the desired experience for end users to discover the Identity Provider they are going to use for login:

Are end users going to be just directed to the Service Provider, and a discovery page should appear if needed?
Are end users going to be directed to a website page, and discovery should be embedded on that page?
Do you want to avoid discovery, and you know enough about each audience segment that we just want to embed static links on one or more website pages?

The answers to these questions will also influence the style of Discovery you choose.

Step 3 - Interactions with other Cirrus Modules / Features

Some Cirrus Modules have constraints that can influence how Discovery is configured:

Cirrus Invitation and Cirrus Account Linking using the organization initiated linking pattern leverage the Discovery configuration to present the UI for request claiming. Decisions made about audience, selected identity providers, and end user experience should align between products (See Invitation Getting Started and Account Linking Getting Started.
Cirrus Self-Registration leverages the Discovery configuration to present the UI for registration. Currently Self-Registration only supports Button Style discovery for the registration UI.
By default, the Cirrus Identity Provider Proxy will use the Discovery configuration of the SP side of the Proxy for all service providers using the Proxy as an IdP (See Identity Provider Proxy Getting Started). In some cases, this can be changed -- contact Cirrus Support for further details.

Step 4 - Select the style of Discovery to implement

The most common choice is to use a SAML compliant discovery service, and the easiest is to use Cirrus Discovery integrated with the Cirrus Identity Products. Cirrus Discovery operates in two basic modes: “List Style” and “Button Style”. The following table providers a comparison between the two styles:

Discovery Style	Button Style	List Style
Recommended Number of Identity Providers	Less than Ten	Large Numbers
Supports Federated IdPs	Yes	Yes
Supports Social Login	Yes	Yes
Supports Custom IdPs	Yes	Yes
Control Display Order of IdPs	Yes	Yes
Add Header/Footer Text	Yes	Yes
Customize IdP Branding (non-social IdPs only)	Yes	No
Add Text Between IdPs	Yes	No
Put IdPs on Different Tabs	No	Yes
Search Box for IdPs	No	Yes
Supports iframe Embedding	No	Yes

Getting Started

The following steps are needed to get started with Cirrus Discovery:

1) Customers should take a moment and think about their Discovery Deployment. Cirrus Identity can offer generally accepted practices, customer stories, and professional services to help. Reviewing the questions covered by the Cirrus Discovery | Planning Steps is a good first step:

Determine your audience
Determine the desired end user experience
Interactions with other Cirrus Modules / Features
Select the style of Discovery to implement

2) Depending on the customer, Cirrus will provision other modules based on the customer’s subscription (or trial/PoC agreement). Modules such as Cirrus Gateway, Cirrus Invitation, Cirrus Account Linking, Cirrus OrgBrandedID, and Cirrus Identity Provider Proxy each have associated setup. See the “Getting Started” for each module as appropriate:

3) If there is an identity provider that is needed by the Discovery audience, but the metadata for the IdP is not published to federation metadata (for example InCommon or eduGAIN), the metadata needs to be sent to Cirrus Identity Support (support@cirrusidentity.com) for configuration.

4) A member of the organization needs to have access to the Cirrus Console and to be granted the “Organization Administrator” (org admin) role for your organization (See Cirrus Console Getting Started).

5) If the SP (or SP side of a Cirrus Identity Provider Proxy) has not already been defined in the Console, an org admin will create the SP in the Console so it can be configured. At this point, the org admin may also designate an SP admin to complete the setup.

6) From the Cirrus Console, an admin will start the Discovery configuration by picking the required identity providers -- social providers will automatically be included based on the Cirrus Gateway configuration (see Cirrus Gateway Getting Started).

7) From the Cirrus Console, an admin will then:

Adjust the ordering of the identity providers
Choose either “Button Style” or “List Style”
For “Button Style”; be sure to apply branding for the IdP buttons, and any “spacer” text between the IdP buttons
For “List Style”; options include configuring two tabs to list sets of IdPs separately, configuring for use with iframes, and configuring for search
Add any desired header or footer text

8) From the Cirrus Console, the admin can save and preview the Discovery configuration

9) Change the configuration for all SPs that will use Cirrus Discovery - the discovery URL should be set to "https://apps.cirrusidentity.com/console/ds/index". Details for configuring a Shibboleth SP are available here.

Once these steps are complete, you are ready to use Discovery.

Discovery | Getting Started

Customers will often subscribe to one or more additional Cirrus Identity modules to support desired implementations. Cirrus Discovery is included with all Cirrus Identity subscriptions.

The following steps are needed to get started with Cirrus Discovery:

Customers should take a moment and think about their Discovery Deployment. Cirrus Identity can offer generally accepted practices, customer stories, and professional services to help. Reviewing the questions covered by the Cirrus Discovery | Planning Steps is a good first step:
- Determine your audience
- Determine the desired end user experience
- Interactions with other Cirrus Modules / Features
- Select the style of Discovery to implement
Depending on the customer, Cirrus will provision other modules based on the customer’s subscription (or trial/PoC agreement). Modules such as Cirrus Gateway, Cirrus Invitation, Cirrus Account Linking, Cirrus External Identity Provider, and Cirrus Identity Provider Proxy each have associated setup. See the “Getting Started” for each module as appropriate:
If there is an identity provider that is needed by the Discovery audience, but the metadata for the IdP is not published to federation metadata (for example InCommon or eduGAIN), the metadata needs to be sent to Cirrus Identity Support (support@cirrusidentity.com) for configuration.
A member of the organization needs to have access to the Cirrus Console and to be granted the “Organization Administrator” (org admin) role for your organization (See Cirrus Console Getting Started).
If the SP (or SP side of a Cirrus Identity Provider Proxy) has not already been defined in the Console, an org admin will create the SP in the Console so it can be configured. At this point, the org admin may also designate an SP admin to complete the setup.
From the Cirrus Console, an admin will start the Discovery configuration by picking the required identity providers -- social providers will automatically be included based on the Cirrus Gateway configuration (see Cirrus Gateway Getting Started).
From the Cirrus Console, an admin will then:
- Adjust the ordering of the identity providers
- Choose either “Button Style” or “List Style”
- For “Button Style”; be sure to apply branding for the IdP buttons, and any “spacer” text between the IdP buttons
- For “List Style”; options include configuring two tabs to list sets of IdPs separately, configuring for use with iframes, and configuring for search
- Add any desired header or footer text
From the Cirrus Console, the admin can save and preview the Discovery configuration
Change the configuration for all SPs that will use Cirrus Discovery - the discovery URL is "https://apps.cirrusidentity.com/console/ds/index". Details for configuring a Shibboleth SP are available here.

Once these steps are complete, you are ready to use Discovery.

Using Discovery Service

Configuring Identity Providers

The top of the Discovery Service page is where you configure which Identity Providers are allowed to access the Service Provider. There are lists for different Federations of Identity Providers as well as custom federations that have been created by Cirrus Identity to support customer deployments (for example the "Athena Federation" supports our demonstration organization).

To add an identity provider to Discovery , checking the box to the left. The identity provider will appear in the Selected IdPs list. To draw attention to specific identity providers in the Discovery interface, drag them to the “Preferred Providers” list. Preferred providers are listed in the order presented and can be placed on a separate tab in Discovery if desired.

If Cirrus Gateway is also being used, any Social Login Providers will also appear in the Selected IdPs. As with traditional identity providers, the Social Login Provider can be placed on the left to appear in a preferred position.

See Cirrus Discovery getting started for more details.

List style discovery is the default when a Service Provider is first configured. Unless Identity Providers are moved to the “Preferred Providers” column, providers are listed in alphabetical order when presented for discovery.