---
title: Setup Wired SSO
slug: setup-wired-sso
createdAt: 2026-11-02T18:12:17.681Z
---

## Overview

Wired SSO lets employees approve their own laptops and docking stations by signing in with your identity provider (IdP). A device starts in a pre-authentication segment, passes through SAML SSO, and then moves to the post-authentication segment.

You can set up Wired SSO in one of two places in the Nile Portal, depending on what is configured in your organization:

- **Wired SSO** tab: Appears when an IdP is configured and Nile Guest Service is not set up.
- **Wired Secured Guest & SSO** tab: Appears when Nile Guest Service is enabled and its guest SSID is configured. Turn on the **Wired SSO** toggle and leave the **Wired Secured Guest** toggle off.

## Prerequisites

Complete the following before you enable Wired SSO. Each step has a dedicated page with detailed instructions.

- **Configure a Service Area.** Define the sites, buildings, and floors where you need Nile connectivity. See [Setup Service Areas.](docId\:M0t6wvhGlM1aU6ECyhJ10)
- **Configure SSO.** Integrate your identity provider (IdP) with Nile. See Okta, Microsoft Entra ID, or Google Workspace.
- **Configure DHCP.** Create separate DHCP pools for the pre-authentication and post-authentication SSO segments. Refer to [Setup DHCP](docId\:yF0RQ3chVX1tCLBSyaMV7) for configuration details.
- **Configure Segments.** Create a pre-authentication segment that uses the short-lease pool, and choose the post-authentication segment, such as your existing employee segment. Ensure that you use the pre-authentication segment only for Wired SSO, and not for another other rules like OUI or fingerprint. See [Setup Segments.](docId\:PEbVdf0dbCBqaExUuX6Af)

## Configuration Steps

### Option 1: Configure on the Wired SSO tab

Use this option when an IdP is configured and Nile Guest Service is not set up. This tab shows only the two segment fields, with **Delete** and **Save** buttons. There are no toggles.

1. Log in to the Nile Portal.
2. In the left navigation, select **Network Setup > Access Management**, and open the **Wired SSO** tab.
3. **Pre-authentication segment:** Select the restricted segment that devices use before they sign in.
4. **Post-authentication segment:** Select the segment that signed-in users join.
5. Click **Save**.

Nile creates a catch-all rule that uses these two segments.

To remove Wired SSO that you configured on this tab, click **Delete**.

### Option 2: Configure on the Wired Secured Guest & SSO tab

Use this option when Nile Guest Service is enabled and you want Wired SSO without Wired Secured Guest.

1. Log in to the Nile Portal.
2. In the left navigation, select **Network Setup > Access Management**, and open the **Wired Secured Guest & SSO** tab.
3. Turn on the **Wired SSO** toggle. Leave the **Wired Secured Guest** toggle off.
4. Configure the following:
   - **Pre-authentication:** Select the starting segment. Devices here have only limited access, for example, only the sign-in page.
   - **Post-authentication:** Select the destination segment after login. Devices here have full access as employees or approved guests.
5. Click **Save**. Click **Reset** to discard unsaved changes.

To remove Wired SSO that you configured on this tab, turn off the **Wired SSO** toggle and click **Save**.

## Wired SSO behavior

### Sign-in and segments

- **Scope:** Wired SSO applies at every location where these segments are used. It cannot be turned on for only some locations.
- **Segment after sign-in:** When a user joins the network, they are initially assigned to the pre-authentication segment. They are then redirected to the SSO portal for authentication. Once SSO authentication is successful, the user is automatically transitioned to the post-authentication segment.
- **Session status:** The device list shows SSO states such as **SSO Initiated**, **SSO Pending**, **SSO Approved**, **SSO Denied**, and **SSO Session Expired**.

### Devices without a browser

Printers, sensors, and similar devices cannot sign in. They get an IP address in the pre-authentication segment and show as **Waiting for approval**. To move them to the right segment, use one of these options:

- Approve them manually.
- Add a fingerprint rule.
- Let users register them through the self-registration portal.

## Additional controls

- Set the SSO session duration (1 day to 1 year) on the IdP page under **Global Settings > Identity**.
- Check how a device was approved in the **Authenticated By** column of the **Wired** table, for example, SSO or captive portal.

For more answers, see the [Wired SSO FAQ.](docId\:NOomRjsdVtEsGQUH1qe23)