Single sign-on · Setup guides
Rippling
Create a custom SAML app in Rippling and connect it to OrbitID. You need a Rippling administrator account.
Step 1: Create application
You'll need to create a new Custom App from your Rippling account if the app is not already in the Rippling app directory.
Go to IT Management > Custom App from the left navigation menu.
Click the Create New App button to create a new application.
From the next screen, fill in the following fields:
- App Name
- Select Categories
- Upload Logo
- What type of app would you like to create? – make sure you select Single Sign-On (SAML) from the list.
Step 2: Configure application
Copy the IdP Metadata URL or IdP Metadata XML from the next screen. You'll need this value to finish the connection in OrbitID.
You'll need to enter the ACS URL and Service Provider Entity ID:
- ACS URL
- https://app.orbitid.com/api/oauth/saml
- The ACS URL shown in your OrbitID Configuration page. Sandbox uses https://app.orbitid.com/api/oauth/sandbox/saml.
- Service Provider Entity ID
- https://saml.orbitid.com
- The SP Entity ID shown in your OrbitID Configuration page. Sandbox uses https://saml.orbitid.com/sandbox.
From the Settings tab of the custom app you just created, go to the Advanced SAML Settings section and check the box for Disable InResponseTo field in assertions for IdP initiated SSO.
This is because Rippling sends dummy values for the InResponseTo field and OrbitID validates the InResponseTo field when it is present.
Rippling sends the user's email and name attributes by default; OrbitID maps them to email, firstName and lastName.
Step 3: Use the IdP metadata
Use the IdP Metadata URL or IdP Metadata XML you copied in Configure application.
Finish in OrbitID
Finish in OrbitID: paste the IdP metadata URL or XML into the connection form (or the Admin Portal link). In the dashboard, open the environment, go to Connections, click New connection, choose SAML and paste the metadata URL or the XML you downloaded. If your customer's admin is following an Admin Portal link, they paste it into the final step of the portal instead.
You can also create the connection with the API: POST /api/v1/sso as described in the quickstart.
