ACS URL*(Single Sign-On URL)

An Assertion Consumer Service (ACS) URL is an endpoint on a Service Provider (SP) that tells an Identity Provider (IdP) where to redirect an authenticated user after sign-in. These are the URLs a user uses to log in to an application via SSO. The ACS URL is also known as the Single Sign-On URL.

Manager Portal ACS URL (SSO URL):
https://manager.everbridge.net/saml/SSO/{API_NAME}/alias/defaultAlias

Member Portal ACS URL (SSO URL)
https://member.everbridge.net/saml/SSO/{API_NAME}/{ORG_ID}/alias/defaultAlias

• API_NAME is defined when configuring SSO
• ORG_ID The Member Portal ACS URL needs to be bound to an Organization to take effect. To find the Organization ID, see knowledge article EBS: Locating Your Organization Details in Everbridge Suite

API Name

{API_ NAME}

API Name is a unique name used by the API that you create to identify your SSO configuration. API names must be unique across all Organizations and Accounts. Everbridge uses this attribute to generate an Everbridge Login URL. If you attempt to enter an already used API Name, Everbridge will generate an error.

When setting up Single Sign-On (SSO) access, it is important to consider how you will gain access to Everbridge should there be an SSO outage. Creating Break Glass Access is the best answer for scenarios like this.

'Break Glass Access' or 'Break Glass Credentials' refer to a set of backup credentials (username and password) that allow users to sign into the Everbridge platform directly without using Single Sign-On (SSO).

See knowledge article  EBS: Single Sign-On (SSO) Break Glass Access in Everbridge Suite for information on setting up Break Glass Access.

When Signature Validation is enabled, this allows for additional SSO security. Confirm that your IdP settings are also enabled for signed SAML Assertion or both SAML Response and Assertion.

The Entity ID (Entity ID URL) is a unique identifier for an Identity Provider or Service Provider. It is used to identify each party in the SSO process.The Entity ID is also known as the issuer.

Manager Portal Entity ID:
https://sso.everbridge.net/{API_NAME}

Member Portal Entity ID:
https://sso.everbridge.net/{API_NAME}/{ORG_ID}

• API_NAME is defined when configuring SSO
• ORG_ID The Member Portal Entity ID needs to be bound to an Organization to take effect. To find the Organization ID, see knowledge article EBS: Locating Your Organization Details in Everbridge Suite

The Everbridge Login URL is the web address (URL) for logging in to the Manager Portal directly using a username and password (break glass account). This is an auto-populated field and invisible at creation.

Example: https://manager.everbridge.net/login

The Everbridge Service Login URL is the unique URL that users will access to log in to the Manager Portal using SSO. This is an auto-populated field and invisible at creation.

Example: https://manager.everbridge.net/saml/login/{API_NAME}

The NameID is the unique identifier or Attribute for a user in the IdP and must be unique within the IdP. The NameID is also known as the Attribute that the Idp sends to Everbridge and must exactly match the user's Everbridge SSO User ID.

IMPORTANT: The SSO User ID in Everbridge is case sensitive so the NameID must be an exact match to the SSO User ID including case sensitivity.

Organization ID

{ORG_ID}

Security Assertion Markup Language (SAML) is an open standard that allows users to sign in once and access multiple applications using the same credentials. SAML works by allowing an identity provider (IdP) to verify a user's identity and then pass that information to a service provider (SP) that runs the application or service the user wants to access. SAML makes SSO technology possible by providing a way to authenticate a user once and then communicate that authentication to multiple applications.

SAML Assertions are the messages that are exchanged between an Identity Provider (IdP) and Service Provider (SP) that confidentially identify who a user is, what pertinent information exists about them, and what they are authorized or entitled to access. Assertions are recorded and transferred as XML documents to standardize communications between the IdP and SP. The SAML response is sent in lieu of a username and password being shared over the wire.

For the SAML Identity Location Everbridge recommends using the "Identity is in the Nameldentifier element of the Subject statement" option as opposed to an attribute as the attribute is typically not what you think it is.  For example, you might think it is an e-mail address, but in your Identity Provider, it is something completely different.

The location in the assertion where a user should be identified. Select either of the following:

• Identity is the NameIdentifier element of the Subject statement
• Identity is in an Attribute element

Service Provider Initiated Request Binding is a mechanism used to request how SAML messages are sent between an Identity Provider (IdP) and a Service Provider (SP).

• HTTP POST uses base64-encoded HTML forms to send SAML messages. This binding is often used for larger or sensitive messages that should not be exposed in the URL.
• HTTP Redirect uses base64-encoded and URL-encoded SAML messages with URL parameters.This binding is typically used in authentication requests.

Service Provider Metadata is an XML file that defines your Everbridge SSO configuration. The Manager Portal has an account metadata file and the Member Portal has either an account metadata file or an Organization metadata file depending on how it is configured.

SSO User ID is the corporate username associated with a user for authenticating with their IdP allowing them access to multiple applications and websites with the same username. SSO usernames are ALWAYS case sensitive. The SSO User ID defined in Everbridge must exactly match the NameID defined in your IdP including case sensitivity.

Just like the NameID, the SSO User ID is also known as the Attribute being sent from the Idp.

IMPORTANT: The SSO User ID in Everbridge is case sensitive so the NameID must be an exact match to the SSO User ID including case sensitivity.

VCC Service Login URL is the unique URL that users will access to log in to VCC using SSO. This is an auto-populated field, invisible at creation.

Example: https://sampleclient.vcc.everbridge.net/