​
Overview

This guide outlines the requirements and steps for setting up SAML Single Sign-On (SSO) integration with our application. SAML 2.0 allows users to authenticate through their organization’s Identity Provider (IdP).
Note: Before starting the integration, ensure you have admin access to your Identity Provider and the necessary certificates ready.

​
Requirements

​
From Identity Provider (Client)

The following information is required from your Identity Provider:
  1. Sign In URL (SSO URL)
    • The endpoint where authentication requests will be sent
    • Example: https://your-domain.okta.com/app/your-app/sso/saml
  2. X.509 Signing Certificate
    • Public certificate in PEM or CER format
    • Used to verify SAML response signatures
    • Must use SHA-256 as the digest algorithm
  3. Entity ID (Issuer)
    • Unique identifier for your Identity Provider
    • Example: urn:your-company:idp or https://your-domain.okta.com
  4. Sign Out URL (Optional)
    • Endpoint for single logout requests
    • Example: https://your-domain.okta.com/app/your-app/slo/saml

​
Information We Provide

We will provide the following information for configuring your Identity Provider:
  1. Assertion Consumer Service (ACS) URL
    • Where SAML assertions should be sent
    • Example: https://example-app.com/api/auth/saml/callback
  2. Service Provider Entity ID
    • Our application’s unique identifier
    • Example: urn:example-app:sp
  3. Callback URLs
    • Valid URLs for post-authentication redirects
    • Example: https://example-app.com/protected-route

​
User Attributes

Attribute NameDescriptionRequiredExample
emailUser’s email addressYes[email protected]
firstNameUser’s first nameYesJohn
lastNameUser’s last nameYesDoe
groupsUser’s group membershipsNo[“admin”, “user”]

​
Security Requirements

​
Encryption and Signing

  • SAML responses must be signed using RSA-SHA256
  • Encryption is optional but supported
  • TLS 1.2 or higher required for all communications

​
Certificate Requirements

  • X.509 certificates must use SHA-256 digest algorithm
  • Minimum 2048-bit key length
  • Valid for no more than 2 years
  • Must be renewed 30 days before expiration

​
Next steps

You can email us the following information to [email protected]:
  • Sign In URL: YOUR_SIGN_IN_URL
  • X.509 Signing Certificate: YOUR_CERTIFICATE (PEM or CER format)
  • Entity ID: YOUR_ENTITY_ID
  • Sign Out URL (Optional): YOUR_SIGN_OUT_URL