Networking Minerva User Guide
Networking Minerva User Guide
Breadcrumbs

Configure SSO

Configure single sign-on (SSO) after the NVIDIA Minerva stack is running and the initial platform administrator can sign in locally. NVIDIA Minerva uses a system-wide OpenID Connect (OIDC) identity provider.

For role definitions and ongoing user administration, see User Management.

Before You Begin

  • Sign in as a Platform Admin. Tenant-scoped administrators cannot change system-wide SSO.

  • Keep a tested local Platform Admin account available until SSO validation is complete.

  • Obtain the OIDC client ID, client secret, authorization endpoint, token endpoint, and userinfo endpoint from the identity provider administrator.

  • Confirm which tenant should receive users authenticated through this provider.

  • Decide whether credentials must be sent in the token request header or body and whether access will be unrestricted, allow-listed, or deny-listed by email address.

Register NVIDIA Minerva with the Identity Provider

  1. In the NVIDIA Minerva UI, open Settings, then Single sign-on.

  2. At the top of the page, turn on the SSO toggle. The SSO settings are hidden while SSO is disabled.

  3. Register NVIDIA Minerva as an OIDC client in the identity provider using this callback URL:

    <BASE_URL>/identity/realms/minerva/broker/<tenant-name>/endpoint

    Replace <BASE_URL> with the externally reachable base URL used to access NVIDIA Minerva, preserving any path prefix and omitting a trailing slash. Replace <tenant-name> with the exact tenant selected in Assign To Tenant.

    The setup hint in some NVIDIA Minerva versions can display the literal BASE_URL placeholder, and its tenant value might not update. If either value is a placeholder or is incorrect, construct the callback URL using the pattern above instead of copying the displayed example.

  4. Configure the identity provider to return the openid, profile, and email scopes. The user profile must include an email or mail claim.

Configure SSO

  1. Confirm that the SSO toggle at the top of Settings > Single sign-on is enabled and that the configuration settings are visible.

  2. Enter the Client ID and Client Secret.

  3. Select Assign To Tenant. Use the same tenant name supplied in the callback URL.

  4. Enter the Authorization, Token, and Userinfo endpoints.

  5. Confirm the required scopes openid, profile, and email.

  6. Select whether to send credentials in the request Header or Body, as required by the identity provider.

  7. Configure email access control:

    • An empty email list permits all SSO users.

    • Allow list permits only the listed addresses.

    • Deny list blocks the listed addresses.

  8. Click Save changes.

Validate Onboarding

  1. Open a private browser window or sign out without closing the Platform Admin session used for configuration.

  2. Sign in through SSO with a test account.

  3. Confirm that the account is assigned to the intended tenant and has the intended tenant-scoped role.

  4. Confirm that the user can open the expected dashboards but cannot access platform administration unless explicitly granted Platform Admin access.

  5. Test at least one denied or unapproved account if an allow or deny list is configured.

  6. After validation, onboard the remaining users and groups according to User Management.

If SSO fails, verify the callback URL, endpoint reachability, TLS trust, client credentials, required scopes, and the email claim before disabling the local administrative account.

Last updated: