Starburst Documentation
Starburst Galaxy
  •  Get started
  •  Working with data
  •  Data engineering
  •  Developer tools
  •  Cluster administration
  •  Security and compliance
  •  Troubleshooting
  • Galaxy status
  •  Reference

    • starburst galaxy > security and compliance > manage galaxy access > manage sso integration > Single sign-on basics

    Single sign-on basics #

    These pages describe how administrators can configure your site’s single sign-on (SSO) identity provider to include Starburst Galaxy as a supported application. This allows users to log in to the identity provider, after which access to Galaxy proceeds without further login prompts.

    Galaxy supports three identity providers (IdPs). See configuration details for the steps to configure one of these IdPs:

    SAML authentication #

    Starburst Galaxy supports IdPs that implement Security Assertion Markup Language (SAML) 2.0 authentication. SAML is an open standard for transferring identity data between an identity provider and a service provider, using XML data structures and HTTP/S, or SOAP, as data transport mechanisms.

    SCIM support #

    If the IdP supports it, you can also configure the IdP and Galaxy to exchange user and group information through System for Cross-domain Identity Management (SCIM), which is a standard protocol for automating the exchange of user identity information between identity domains.

    With SCIM configured, the IdP can push changes in user and group membership, including deletions, to a Starburst Galaxy account configured to receive that information. This can occur on a regular schedule, or as changes happen, or administrators can request an on-demand update.

    Galaxy administrators are still in charge of assigning individual users and groups to roles, and are thereby still in charge of how much each user or group of users can do and see in Galaxy.

    Galaxy supports a subset of all SCIM fields. If the SCIM integration is configured to send unsupported fields, they will be ignored. Galaxy supports the following SCIM fields: userName, active, displayName, name.givenName, name.familyName, name.honorificPrefix, name.honorificSuffix and password.

    Configuration overview #

    The overall steps to configure Galaxy to use a supported SSO IdP are the following:

    1. Begin creating an SSO configuration in Galaxy. The first step is SAML.

    2. Copy the Galaxy SAML configuration strings to your IdP. This allows your IdP to generate and present you with the information needed by Galaxy.

    3. Copy the IdP SAML configuration strings back to Galaxy.

    4. Now you’re done with SAML, next is SCIM.

    5. Go to your IdP and enable SCIM. Enter the Galaxy SCIM information.

    6. Test the new configuration.

    Configuration details #

    See the following pages for IdP-specific configuration details.

    Starburst Galaxy supports SSO client access with the Trino CLI, JDBC driver, and ODBC driver.

    Other useful resources: