SAML 2.0 configuration checklist

Collect the provider values

Paste the public signing certificate, never its private key. The current profile uses signed POST assertions, signed authentication requests and persistent NameID. Qualify other provider profiles before promising support.

• The exact identity-provider entity ID.
• The public HTTPS single sign-on endpoint.
• The public RSA X.509 signing certificate, at least 2048 bits and valid for at least seven more days.

Configure the company provider

Do not guess an ACS path from an example hostname. Each installation’s displayed values are authoritative.

1. Copy the exact service-provider entity ID and ACS URI shown in Company settings.
2. Obtain the service-provider metadata or signing certificate from the platform operator because authentication requests are signed.
3. Configure the approved identifier and account mapping for an existing company member.
4. Submit the draft for validation and operator activation.

Acceptance test

Expired certificates, mismatched entity IDs, assertion audience or destination errors, clock differences and an unlinked subject require investigation with your identity administrator. Never send a raw assertion or session cookie in a support ticket.

1. Use Test company sign-in after activation.
2. Authenticate with the approved company-provider account.
3. Confirm the expected company and role in the returned workspace.
4. Confirm the verified sign-in status is recorded for the current revision.
5. Test a user without membership and confirm they do not gain company access.