Skip to content
Contact us
  • There are no suggestions because the search field is empty.

Manual setup of SSO config

This doc will be useful even if doing an import using a Federation Metadata XML URL, as the field mappings are not yet importable, and they can be gleaned in the same way as in the manual setup.

The first thing we need is the Metadata XML file. If provided the URL, visit that page to find the details

We need the following from the XML contents:

  • An Entity ID
  • A login URL
  • An x509 certificate
  • Field mappings (1 unique, preferably 1 each for email, first name, last name)

You can download the example XML file here (an example from one of our Azure Active Directories). We can find the above by searching:

  • entityID - at the top, it is entityID="https://sts.windows.net/667d9a8d-34fd-4ea9-99a5-b740e26edaac/". We copy https://sts.windows.net/667d9a8d-34fd-4ea9-99a5-b740e26edaac/ (the final forward-slash is important) over to the SSO config
  • SignOnService - at the bottom, it is <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/667d9a8d-34fd-4ea9-99a5-b740e26edaac/saml2" />. We copy over https://login.microsoftonline.com/667d9a8d-34fd-4ea9-99a5-b740e26edaac/saml2
  • X509Certificate - near the top, in a truncated form, it is <ds:X509Certificate>MIIC8DCCAdigAwIBA...</ds:X509Certificate>. We copy over the MII... value
  • ClaimType - we have a number of fields here under ClaimType, we want to map 1 that indicates it is unique to Unique ID our end, and then 1 each for whichever seems like first name, last name and email. Note that if there is no unique ID field, you could probably specify the email field as the unique ID field. In this instance, we do have a unique ID field, so we set up the field mappings:
    • Unique ID - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
    • First name - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
    • Last name - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
    • Email - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress