Activate SAML SSO

After you finish the required SAML SSO configuration between your identity provider and Redis Cloud account, you can test and activate SAML SSO.

All users associated with the account, excluding the local user you used to set up SAML SSO, are converted to SAML users on successful activation. They can no longer sign in with their previous sign-in method and must use SAML SSO instead. However, you can add local bypass users after SAML SSO activation to allow access to the account in case of identity provider downtime or other issues with SAML SSO.

To activate SAML SSO:

1. Sign out of any active SSO sessions with your identity provider.

2. For Activate SAML integration, select the Activate button.

3. From the Logout notification dialog, select Continue. This redirects you to your configured identity provider's sign-in screen.

4. Sign in with your identity provider.

5. When redirected to the Redis Cloud sign-in screen, you can either:

   • Sign in with your local credentials as usual.

   • Select SSO and enter the email address associated with the SAML user configured in your identity provider. Your user converts to a SAML user in Redis Cloud. Don't use this method if you want your user account to remain a local bypass user.

   Note:

   If you see a SAML activation failed notification when redirected to the Redis Cloud sign-in screen, sign in with your local user credentials and review the SAML configuration for issues.

After you activate SAML SSO, add a few local bypass users from the Team tab. Local bypass users should set up MFA for additional security.

Update configuration

If you change certain metadata or configuration settings after you set up SAML SSO, such as the assertion signing certificate, remember to do the following:

1. Update the SAML SSO configuration with the new values.

2. Download the updated service provider metadata and use it to update the Redis Cloud service provider app.

Link other accounts

After you set up SAML SSO for one account, you can link other accounts you own to the existing SAML configuration. This lets you use the same SAML configuration for SSO across multiple accounts.

To link other accounts to an existing SAML SSO configuration:

1. Sign in to the Redis Cloud console with the account that has an existing SAML configuration.

2. Go to Access Management > Single Sign-On.

3. Select Get token.

   

   Select Copy to copy the linking token.

4. Sign in to the account that you want to link to the SAML configuration. Go to Access Management > Single Sign-On and then enter the copied token into the Join an existing SAML configuration text box. Select the arrow to confirm.

   After you do this, the owner of the original account will receive a request to link the new account to the SAML configuration.

5. Sign in with the original account and select Access Management > Single Sign-On. You should see the new account in the Unlinked accounts list.

   Note:

   To see and interact with the Redis Cloud account in the Unlinked accounts list, you must be an owner of the account. If you are not an owner, the account will not be displayed in the section.

6. Select Link account.

   

7. In the Convert existing users dialog, select Confirm conversion to finish linking the accounts.

   

Deactivate SAML SSO

Before you can deactivate SAML SSO for an account, you must sign in to the account as a local (non-SAML) user with the owner role assigned.

Deactivating SAML SSO for an account also removes any existing SAML-type users associated with the account.

To deactivate SAML SSO for a specific account:

1. In the Redis Cloud console, select your name to display your available accounts.

2. If the relevant account is not already selected, select it from the Switch account list.

3. Go to Access Management > Single Sign-On.

4. Select Deactivate SAML. This only deactivates SAML SSO for the current account. Other linked accounts continue to use this SAML SSO configuration.

5. Select Deactivate to confirm deactivation.

Deprovision SAML users

When a user is removed from your identity provider, their access to Redis Cloud should also be removed.

When you have revoked a user’s access to Redis Cloud, they cannot access the Redis Cloud console, but their API keys remain active. You can delete an API key to remove access.

To deprovision SAML users upon deletion, the identity provider admin can set up a webhook to automatically make the appropriate Cloud API requests. For more information about managing users with API requests, see Users in the Redis Cloud API documentation.