Single Sign-On

TraceLink Single Sign-On (SSO) and Company SSO enable users in your company to authenticate seamlessly across Tracelink apps, networks, and Links. When your company is enabled for either TraceLink SSO or Company SSO, newly added users are automatically provisioned with SSO access. If your company is not yet enabled for either option, contact Tracelink Support to enable SSO for your company and all associated users.

System Administrators can manage SSO settings for user accounts, including enabling, disabling, or verifying a user’s SSO status. Users added through Track & Trace Services (TTS) Administration will also inherit TraceLink SSO access if their company is enabled for Tracelink SSO or Company SSO.

For OPUS-enabled companies, login information no longer appears in the Track & Trace Services. Fields such as Last Failed Login, Password Expires On, and Password Status are blank. This information remains available in the OPUS UI.

  1. Select the Main Menu icon.

  2. Select Administration in the main menu.

  3. Select Single Sign-On Settings from the left menu.

  4. Select Sign-On Settings from the left menu.

  5. View the following information in the Single Sign-On Settings Details screen:
    1. General section – Selected authentication method, multi-factor authentication status, and session timeout duration. View the selected authentication method, multi-factor authentication status, and session timeout duration.
    2. Failed Login Attempts section – Configured limit for failed login attempts allowed, automatic account unlock timing, and unlock account status.
    3. Password Settings section – Password expiration status, expiration period, and restrictions on reusing previous passwords.
    4. Company Single Sign-On Settings section – Company’s SSO certificate and URL, along with the SP Entity ID and Assertion Consumer Service (ACS) or Redirect URL.

  6. Select the Edit button.

  7. Fill the following information in the General section:

    1. Authentication Method drop-down – The type of authentication required to log in to TraceLink.

      • Tracelink SSO – This is the default option. Authenticates users through the TraceLink’s SSO system.
      • Company SSO – Authenticates users through the company’s own SSO system.

    2. Multi-factor Authentication (If enabled, user must also use a secondary authentication method) switch – A second layer of authentication when using Tracelink SSO for your company users. This switch is enabled only when you select Tracelink SSO from the Authentication Method drop-down.

      • Enabled – Multi-factor authentication is required for all users.
      • Disabled – Multi-factor authentication is explicitly disabled.
    3. Session Timeout (Minutes) field – Specify the session timeout duration for users in your company.

    4. IP Address Restriction switch – Associates an active user session with the IP address used to establish the session and might require reauthentication if the IP address changes.

      • Enabled – Associates an active user session with the IP address used to establish the session. Reauthentication might be required if the IP address changes.
      • Disabled – Does not restrict an active user session to the IP address used to establish the session.
  8. Fill the following information in the Failed Login Attempts section. This section is enabled only when Tracelink SSO is selected in the Authentication Method drop-down.

    1. Failed Login Attempts Allowed field – Set the maximum number of failed login attempts before the account is locked.

    2. Auto-Unlock Account (If disabled, an administrator must manually unlocked the account) switch – Unlock account after a specific number of minutes. If not enabled, the account must be unlocked by an administrator.
      • True – The account is automatically unlocked after the specified duration.
      • False – The account remains locked; a password reset is required to regain access.

    3. Unlock Account After (minutes) field – This field is enabled only when the Auto-unlock Account After Specific Duration option is set to Enabled. Set the time interval after which a locked account is automatically unlocked.

      • Enabled – Multi-factor authentication is required for all users.
      • Disabled – Multi-factor authentication is explicitly disabled.

  1. Fill the following information in the Password Expiry and Reuse Settings section. This section is enabled only when Tracelink SSO is selected in the Authentication Method drop-down.

    1. Password Auto Expires switch – Automatically expires user passwords after a defined period.

      • Yes – Associates the active user session with the IP address used to establish the session. If the IP address changes, the user might be required to authenticate again.
      • No – Restrict Sessions by IP Address is explicitly disabled.

    2. Password Expiration (days) field – Specify the number of days after which the password expires. This field is enabled only when the Password Auto Expires switch is set to Enabled.

    3. Restrict Reuse of Passwords switch – Set whether to prevent users from reusing their previous passwords.

      • Yes – Restricts the reuse of previous passwords.
      • No – Allows users to reuse previously used passwords without restriction.

    4. Number of Passwords Restricted for Reuse field – Set the number of previous passwords that cannot be reused. This field is enabled only when the Restrict Reuse of Previous Passwords switch is set to Enable.

  1. Fill the following information in the Password Composition Criteria section. This section is enabled only when Tracelink SSO is selected in the Authentication Method drop-down.

    1. Minimum Password Length field – Specify the minimum number of characters required for a user password.

    2. Minimum Number of Numeric Characters field - Specify the minimum number of numeric characters required in a user password.

    3. Minimum Number of Lowercase Characters field – Specify the minimum number of lowercase characters required in a user password.

    4. Minimum Number of Uppercase Characters field – Specify the minimum number of uppercase characters required in a user password.

    5. Minimum Number of Special Characters field - Specify the minimum number of special characters required in a user password.

    6. Privileged User Minimum Password Length field - Specify the minimum password length for Privileged Users. If no value is configured, the standard Minimum Password Length applies.

    7. Username Similarity Check switch - Set whether to prevent users from setting passwords that conflict with supported username-based password validation rules.

      • Enabled – Prevents users from setting passwords that conflict with supported username-based password validation rules.
      • Disabled – Username Similarity Check is explicitly disabled.

    8. Breached Password Check switch - Set whether to prevent users from setting passwords found in known breach databases.

      • Enabled – Prevents users from setting passwords found in known breach databases.
      • Disabled – Breached Password Check is explicitly disabled.

  1. Fill the following fields in the Company Single Sign-On Settings section. This section is enabled only when Company SSO is selected in the Authentication Method drop-down.

    1. Single Sign-On Certificate field – Required. Enter your company's single sign-on certificate without the certificate header (-----BEGIN CERTIFICATE-----) and footer (-----END CERTIFICATE-----) in the provided text box.
    2. SP Entity ID field – Read-only field displaying the static value https://sso.tracelink.com/auth/realms/opus.
    3. Single Sign-On URL field – Required. Enter your company’s Single Sign-On URL in the provided text box.
    4. Assertion Consumer Service (ASC) OR Redirect URL field – Read-only field displaying the URL where the external IdP redirects the user and sends the SAML response after authentication.

  1. Select the Save button.

    The updated sign-on settings display in the results table.