Single sign-on · Setup guides
Generic SAML
Use this guide for any SAML 2.0 identity provider that does not have its own guide.
Step 1: Configure the SAML application
Your Identity Provider (IdP) will ask for the following information while configuring the SAML application.
Please do not add a trailing slash at the end of the URLs. Create them exactly as shown below:
- Reply URL (Assertion Consumer Service URL)
- https://app.orbitid.com/api/oauth/saml
- The ACS URL shown in your OrbitID Configuration page. Sandbox uses https://app.orbitid.com/api/oauth/sandbox/saml.
- Identifier (Entity ID)
- https://saml.orbitid.com
- The SP Entity ID shown in your OrbitID Configuration page. Sandbox uses https://saml.orbitid.com/sandbox.
Use these signing settings:
- Response:
Signed - Assertion Signature:
Signed - Signature Algorithm:
RSA-SHA256 - Assertion Encryption:
Unencrypted
OrbitID exposes the same values as SP metadata at https://app.orbitid.com/.well-known/sp-metadata; many identity providers can import it directly. The signing certificate is at https://app.orbitid.com/.well-known/saml.cer.
Step 2: SAML profile, claims and attribute mapping
OrbitID reads four attributes from the SAML assertion:
- id
- firstName
- lastName
This is how the common SAML attributes map over for most providers, but some providers have custom mappings. Please refer to the documentation of the identity provider to understand the exact mapping.
| SAML Attribute | OrbitID mapping |
|---|---|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier | id |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | firstName |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | lastName |
Plain attribute names (id, email, firstName, lastName) work as well.
Step 3: Copy the IdP metadata
Download the IdP metadata XML from your identity provider, or copy its metadata URL.
Finish in OrbitID
Finish in OrbitID: paste the IdP metadata URL or XML into the connection form (or the Admin Portal link). In the dashboard, open the environment, go to Connections, click New connection, choose SAML and paste the metadata URL or the XML you downloaded. If your customer's admin is following an Admin Portal link, they paste it into the final step of the portal instead.
You can also create the connection with the API: POST /api/v1/sso as described in the quickstart.
