A service provider can share a common set of applications (for example, Salesforce) across multiple accounts (virtual servers). Each account manages the policies that control how their members access the shared applications. Any application (except the user portal) configured in the STA Access Management console can be shared. Shared applications can include SAML, OIDC, and Next Gen agents. Service providers can share an application with up to 670 accounts that they are delegated to manage.

About shared applications

• SAML return attributes, OIDC claims, application icon, and application name are configured in the shared-from virtual server.

• Configuration changes related to sharing applications are recorded in the audit logs of the shared-from virtual server.

• An account cannot share to other accounts, applications that are shared to them.

• Access and authentication logs are generated and displayed only in the account where the user is found.

• Single Sign On (SSO) behavior extends to shared applications.

• Username searches proceed from top to bottom of the application sharing list. The first match found is applied.

Share an application in STA

To share or un-share an application with another account (virtual server):

1. From the STA Access Management console of the shared-from service provider account, select the Applications tab.

2. From the applications list, select the configured application to be shared.

3. From the application details panel, select the Share tab.

   The Share tab displays for service provider accounts only. This feature is not available to subscriber accounts.

   A list of the virtual servers to which the application is shared displays.

   

4. Select Add Virtual Server.

   A list of virtual servers to which you have delegated permission displays.

   

5. Select the virtual server to which the application will be shared by selecting .

   

   The shared-to virtual server is added to the top of the list of virtual servers that have access to the application.

   By default, the assignment rule for the application in the shared-to virtual server is "No users". Therefore, no users from the shared-to virtual server can access the application until the assignment rule is changed.

   The bottom-most virtual server in the list is the shared-from virtual server.

   

6. (Optional) To un-share an application, select the menu icon on the application that you want to remove and then select Remove.

   

Using a shared application in STA

Applications which are shared-to you display in the applications list as <application name (shared-from account)>. For example, Salesforce New (Main Inc).

The operator of an account that is using a shared application is responsible for:

• Ensuring that policies (for example, the Global Policy) are in place to handle requests related to the shared application. For details, see Add an exception policy.

• Assigning users to the shared application. For details, see Grant or deny access to groups of users.

How STA processes an access request for a shared application

This section describes a user’s experience when they attempt to access a shared application.

To open a shared application:

1. A user opens their browser, navigates to the shared application site, and attempts to log in.

2. The shared application redirects the request to the shared-from account, which presents a login prompt.

   The login page presented at this step is configured by the shared-from account.

3. The user enters their login name.

4. STA searches for the account to which the user is a member and directs the access request to the first match found.

   Searches proceed from top to bottom of the application sharing list.

5. The user's account applies its policies and prompts the user for their credentials.

   The login page presented at this step is configured by the shared-to account.

6. The user enters their credentials and, upon authentication, the shared application opens.

   Events related to the application are recorded in the access log of the user's account. If the user is not found, "Unknown user" is recorded in the access log of the shared-from account.

   Example Access Log: