5.0 Providing Access to the SaaS Applications for Users

After CloudAccess and the SaaS applications are configured, you must provide a way for users to access the SaaS applications.

CloudAccess includes a sample landing page that contains the links for accessing the SaaS applications. You can use this page or create your own page. Access the sample landing page through the following URL:

https://dns_or_ip_of_appliance/osp/a/t1/auth/app

After you enter valid credentials, the sample landing page appears. The sample landing page displays the links for the SaaS applications only after they are configured properly and if you have an entitlement for that SaaS application.

On the sample landing page, the links for the SaaS applications are as follows:

  • Google Apps for Business: https://dns_of_appliance/osp/a/t1/auth/app/its/connectors_GOOGLEAPPS_IDXXX?target=https://mail.google.com/a/your_google_domain

  • Salesforce: https://dns_or_ip_of_appliance/osp/a/t1/auth/app/its/connectors_SFORCE_IDXXX

  • Office 365: https://dns_of_appliance/osp/a/t1/auth/app/its?tpAuthCardId=configured_connector:homedesktop~browser

If you create your own page, copy the links for the SaaS applications from the sample landing page to your landing page.

If you are creating your own landing page, there are two methods to connect to the SaaS applications. You can use either method for your own landing page.

Method 1: Service Provider (SP) Initiated Logins

  1. The user clicks the link https://mail.google.com/a/your_google_domain for a service provider-initiated login.

  2. The browser sends a request to Google Apps for Business.

  3. Google Apps for Business redirects the browser session to the appliance for authentication.

  4. The user enters login credentials.

  5. After a successful authentication against the identity source, the appliance redirects the browser session back to Google Apps for Business with a SAML assertion for authentication.

  6. Google Apps for Business receives the assertion, then allows or denies user access based on the content of the assertion.

Method 2: Identity Provider (IDP) Initiated Logins

  1. The user clicks the link https://dns_of_appliance/osp/a/t1/auth/app/its/connectors_GOOGLEAPPS_IDXXX?target=https://mail.google.com/a/your_google_domain for an identity provider-initiated login.

  2. The browser sends a request to the appliance login URL.

  3. The browser displays the CloudAccess login form.

  4. The user enters the identity source login credentials, then successfully authenticates to the appliance.

  5. The appliance redirects the browser session back to Google Apps for Business with a SAML assertion for authentication.

  6. Google Apps for Business accepts the assertion, then allows or denies access based on the content of the assertion.

Examples

The following are examples of the different logins:

IDP-Initiated Login for Google Apps for Business: https://dns_of_appliance/osp/a/t1/auth/app/its/connectors_GOOGLEAPPS_a20hy?target=https://mail.google.com/a/google_domain

IDP-Initiated Login for Salesforce: https://dns_of_appliance/osp/a/t1/auth/app/its/connectors_SFORCE_a18gs

SP-Initiated Login for Google Apps for Business: There are two options:

  • https://mail.google.com/a/google_domain

  • https://docs.google.com/a/google_domain

SP-Initiated Login for Salesforce: The setup page for this feature at Salesforce is under Setup > Company Profile > My Domain. After Salesforce registers the domain, your URL is similar to the following that allows an SP-initiated login:

https://custom_name.my.salesforce.com

IDP-Initiated Login for Office 365: The IDP-initiated URL for Office 365 is based on the connector name, and will change based on the random name (the last five characters in the following example) of the connector for Office 365 that is created in the system. You can see the URL by hovering over the auth card on the OSP landing page.

https://dns_of_appliance/osp/a/t1/auth/app/its/connectors_O365_XXXXX