Skip to main content

SAML Authentication

Written by SUBSCRIBE

If your company uses an identity provider like OneLogin, Okta, or Azure AD, you may find SAML authentication beneficial. To set up SAML, you must:

  • Have an identity provider

  • Have SAML authentication added to your plan

If you do not have SAML authentication enabled, please contact SUBSCRIBE.

Step One - Configure your identity provider

Service Provider Metadata XML

Azure AD

  1. In the Azure portal, on a newly created application page, find the Manage section and select Single sign-on.

  2. On the Select a Single sign-on method page, select SAML.

  3. On the Set up Single Sign-On with SAML page, click the pencil icon for Basic SAML Configuration to edit the settings.

  4. On the Basic SAML Configuration section, perform the following steps:

    1. In the Reply URL (Assertion Consumer Service URL) input, type the URL: https://api.subscribeplatform.com/users/saml/auth

    2. In the Identifier (Entity ID) input, type the URL: https://api.subscribeplatform.com This value will be used as the Audience URL when configuring SUBSCRIBE.

  5. On the Set up Single Sign-On with SAML page, in the SAML Signing Certificate section, copy the App Federation Metadata URL. This will be used when configuring in SUBSCRIBE.
    ​

Okta

  1. Go to Okta Admin Console

  2. Menu → Applications

  3. Create App Integration → SAML 2.0

  4. On “Configure SAML” tab

    1. In the Single sign on URL input, type the URL: https://api.subscribeplatform.com/users/saml/auth

    2. In the Audience URI (SP Entity ID) input, type the URL: https://api.subscribeplatform.com. This value will be used as the Audience URL when configuring in SUBSCRIBE.

    3. In Name ID format input: Unspecified

    4. In Application username: Email

  5. Click Show Advanced Settings and go to Attribute Statements

    1. Add the following statement:

      1. Name: email

      2. Name Format: Unspecified

      3. Value: user.email

  6. In “Sign On” tab of the new application, copy the URL of “Identity Provider metadata” link

OneLogin

  1. Go to OneLogin Admin Console

  2. Applications → Add App

  3. Search for “SAML Custom Connector (Advanced)”

    1. When prompted, set the Display Name for the application (e.g., SUBSCRIBE) and Save.

  4. On the Configuration tab

    1. In the ACS (Consumer) URL input, type the URL: https://api.subscribeplatform.com/users/saml/auth

    2. In the Audience (Entity ID) input, type the URL: https://api.subscribeplatform.com. This value will be used as the Audience URL when configuring in SUBSCRIBE.

    3. In SAML NameID format, select Unspecified.

  5. On the Parameters tab

    1. Edit SAML NameID and set its value to Email.

    2. Add a new parameter and include it in the SAML assertion:

      1. Name: email

      2. Value: Email

  6. On the SSO tab of the new application

    1. Copy the URL of Issuer URL (Identity Provider Metadata). This will be used when configuring in SUBSCRIBE.

Step Two - Configure SUBSCRIBE

Note: To configure SAML authentication for your organization, you must be an Administrator.

  1. Login to the SUBSCRIBE platform with an existing Administrator.

  2. Access the Settings section in the left hand navigation.

  3. On the Settings Page, under Admin Console, select Security.

  4. Select Add SSO

  5. Make a selection for SAML Options (State)

    1. Select Off if you do not want SAML authentication to be enabled upon setup

    2. Select Optional if you would like members of the organization to be able to use either SAML authentication or password authentication

    3. Select Required if make SAML authentication mandatory for all members of the organization

  6. Add Audience URL.

  7. Add User Email. This is the attribute that defines the email. Common examples are email , emailAddress , or urn:oasis:names:tc:SAML:2.0:email .

  8. Paste the Metadata URL from your identity provider or upload the download XML file.

Did this answer your question?