Networking Minerva User Guide
Networking Minerva User Guide
Breadcrumbs

Configure SSO

Configure single sign-on (SSO) after the NVIDIA Minerva stack is running and the initial Platform Admin can sign in locally. NVIDIA Minerva uses one OpenID Connect (OIDC) identity provider for the whole system, and it applies to every tenant.

For role definitions and ongoing user administration, see Manage Users and Roles.

Before You Begin

  • Sign in as a Platform Admin. Only Platform Admins can see Single Sign On.

  • Keep a tested local Platform Admin account available until SSO validation is complete.

  • Get the OIDC client ID, client secret, and authorization, token, and userinfo endpoints from the identity provider administrator.

  • Know the public address users use to reach NVIDIA Minerva, including any different hostname or reverse proxy.

  • Confirm which tenant should receive users who sign in through SSO.

  • Decide whether the identity provider expects credentials in the token request header or body, and whether to restrict sign-in with an allow list or deny list of email addresses.

Configure SSO

  1. In the upper-right corner, click Settings menu and select Settings. Then select Single Sign On.

  2. Turn on the switch at the top of the page. While SSO is disabled, the provider settings can't be edited.

  3. In Minerva Public URL, check the address that users use to reach NVIDIA Minerva, for example https://minerva.example.com. Include http:// or https://, with no path. It defaults to the deployment URL. To restore that default, click Reset.

  4. In Assign To Tenant, select the tenant for users who sign in through SSO.

  5. Under Provider, enter the Client ID and Client Secret. To keep a saved secret, leave Client Secret blank.

  6. Under Endpoints, enter the Authorization, Token, and Userinfo URLs. For Microsoft Entra ID (login.microsoftonline.com), use the v2.0 endpoints.

  7. Under Scopes & Credentials, select whether to send credentials in the Header or Body. The required scopes openid, profile, and email are set for you.

  8. Under Access Control, optionally choose Allow list or Deny list and add email addresses to Email list:

    • An empty list doesn't restrict SSO sign-in.

    • Allow list permits only the listed addresses.

    • Deny list blocks the listed addresses.

  9. Click Save changes.

To discard unsaved changes, click Revert. To remove the identity provider configuration, click Delete connection.

Register NVIDIA Minerva with the Identity Provider

  1. On the Single Sign On tab, expand Setup instructions.

  2. Copy the Callback URL. To copy it, click the copy icon next to it.

  3. In the identity provider, register NVIDIA Minerva as an OIDC client with that callback URL, and configure it to return the openid, profile, and email scopes. The user profile must include an email or mail claim.

The callback URL is built from Minerva Public URL. If you change Minerva Public URL, save your changes and update the callback URL in the identity provider. After the first save, changing Assign To Tenant doesn't change the callback URL.

Validate Onboarding

  1. Open a private browser window or sign out without closing the Platform Admin session used for configuration.

  2. Sign in through SSO with a test account.

  3. Confirm that the account is assigned to the intended tenant.

  4. Confirm that the user can open the expected dashboards but cannot access platform administration.

  5. Test at least one denied or unapproved account if an allow or deny list is configured.

  6. After validation, onboard the remaining users according to Manage Users and Roles.

If SSO fails, check the callback URL, endpoint reachability, TLS trust, client credentials, scopes, and the email claim before you disable the local administrator account.

Last updated: