Setup Wired SSO

6 min

Overview

Wired SSO lets employees approve their own laptops and docking stations by signing in with your identity provider (IdP). A device starts in a pre-authentication segment, passes through SAML SSO, and then moves to the post-authentication segment.

You can set up Wired SSO in one of two places in the Nile Portal, depending on what is configured in your organization:

Wired SSO tab: Appears when an IdP is configured and Nile Guest Service is not set up.

Wired Secured Guest & SSO tab: Appears when Nile Guest Service is enabled and its guest SSID is configured. Turn on the Wired SSO toggle and leave the Wired Secured Guest toggle off.

Prerequisites

Complete the following before you enable Wired SSO. Each step has a dedicated page with detailed instructions.

Configure a Service Area. Define the sites, buildings, and floors where you need Nile connectivity. See Setup Service Areas.Setup Service Areas.

Configure SSO. Integrate your identity provider (IdP) with Nile. See Okta, Microsoft Entra ID, or Google Workspace.

Configure DHCP. Create separate DHCP pools for the pre-authentication and post-authentication SSO segments. Refer to Setup DHCPSetup DHCP for configuration details.

Configure Segments. Create a pre-authentication segment that uses the short-lease pool, and choose the post-authentication segment, such as your existing employee segment. Ensure that you use the pre-authentication segment only for Wired SSO, and not for another other rules like OUI or fingerprint. See Setup Segments.Setup Segments.

Configuration Steps

Option 1: Configure on the Wired SSO tab

Use this option when an IdP is configured and Nile Guest Service is not set up. This tab shows only the two segment fields, with Delete and Save buttons. There are no toggles.

In the left navigation, select Network Setup > Access Management, and open the Wired SSO tab.

Pre-authentication segment: Select the restricted segment that devices use before they sign in.

Post-authentication segment: Select the segment that signed-in users join.

Click Save.

Nile creates a catch-all rule that uses these two segments.

To remove Wired SSO that you configured on this tab, click Delete.

Option 2: Configure on the Wired Secured Guest & SSO tab

Use this option when Nile Guest Service is enabled and you want Wired SSO without Wired Secured Guest.

In the left navigation, select Network Setup > Access Management, and open the Wired Secured Guest & SSO tab.

Turn on the Wired SSO toggle. Leave the Wired Secured Guest toggle off.

Configure the following:

Pre-authentication: Select the starting segment. Devices here have only limited access, for example, only the sign-in page.

Post-authentication: Select the destination segment after login. Devices here have full access as employees or approved guests.

Click Save. Click Reset to discard unsaved changes.

To remove Wired SSO that you configured on this tab, turn off the Wired SSO toggle and click Save.

Wired SSO behavior

Scope: Wired SSO applies at every location where these segments are used. It cannot be turned on for only some locations.

Segment after sign-in: When a user joins the network, they are initially assigned to the pre-authentication segment. They are then redirected to the SSO portal for authentication. Once SSO authentication is successful, the user is automatically transitioned to the post-authentication segment.

Session status: The device list shows SSO states such as SSO Initiated, SSO Pending, SSO Approved, SSO Denied, and SSO Session Expired.

Devices without a browser

Printers, sensors, and similar devices cannot sign in. They get an IP address in the pre-authentication segment and show as Waiting for approval. To move them to the right segment, use one of these options:

Approve them manually.

Add a fingerprint rule.

Let users register them through the self-registration portal.

Additional controls

Set the SSO session duration (1 day to 1 year) on the IdP page under Global Settings > Identity.

Check how a device was approved in the Authenticated By column of the Wired table, for example, SSO or captive portal.

For more answers, see the Wired SSO FAQ.Wired SSO FAQ.