This documentation describes the SAML Single Sign-on feature guide for the account/user. The document includes detailed steps for activating the SAML SSO feature and configuration steps for OneLogin.
To get access to the SAML Single Sign-on for the account/user, the following steps should be completed:
The subscription plan should support SAML Single Sign-on
The account should be active
The super admin of the account and users should be active
SAML SSO Configuration Steps for OneLogin
Login to the main user’s account
Go to the settings and click on SAML Single Sign-on
Click the Connect Identity Provider button
On the opened page, enter the connection name
Copy the Assertion Consumer Service URL and add it to the OneLogin app configuration page
Note: OneLogin IdP requires only an ACS URL, so there is no need to provide an Entity ID URL.
Download the SAML metadata from IdP after adding the ACS URL
Upload the downloaded metadata to the platform
Enable or Disable the “Force IdP Re-authentication” option
Enable or Disable the “Prepopulate the User Email Address” option
Click the Create Connection button
Your connection is created!
Note: Make sure your users are assigned to your application. After creating the connection, the main user of the account and sub-users get an opportunity to sign in via SAML SSO.
There is an opportunity to specify your domains which will be used to sign in via SAML SSO. For instance, if we add gmail.com it means only the email addresses registered on the platform and IdP side, which include gmail.com will be allowed to sign in via SSO. If the domains are not added, all your email addresses will be allowed to sign in via a SAML connection.
Note:
Once the connection is created, all the users in your account will be able to sign in via SAML SSO. The standard flow for signing in using credentials and Oauth (Google, Microsoft) is not available for account sub-users if the SAML connection is created. If you disconnect SAML, the standard sign-in flows will be available.
The main user of the account can always sign in using credentials, and OAuth regardless of the SAML connection state.
Before signing in via SAML SSO, make sure your users on our platform and IdP side are added and their email addresses are the same on both sides.
Steps to Sign in Via SAML SSO
Navigate to the Sign-in page and click the Sign-in with SSO link
Enter your email address and click the Continue button
You will be redirected to the OneLogin side to provide the username and password
After passing the authentication on the OneLogin side, you will be redirected to your account on our platform
Information about SAML Single Sign-on Login Session.
OneLogin requires the username for the 1st sign-in, then only the password.
Contact us for further information, or read our SSO SAML user guide to configure SSO setups for other identity providers.