SAML 2.0 signs users in against an external identity provider. It is the usual route when a customer already runs their own identity system, and is frequently a procurement requirement for enterprise deals.
Configuring a provider
Each identity provider is a row in the SAML Identity Providers record:
- Identity provider details — entity ID, sign-on address, logout address and certificate. All four come from the provider's own metadata; ask their administrator for it rather than transcribing by hand.
- Service provider details — your entity ID, and optionally a certificate and key. The key is only needed where the provider requires signed requests or encrypted assertions; leave it blank otherwise. It is stored encrypted.
- Attribute mappings — which attribute supplies each user field. Leave the e-mail mapping blank to use the identifier itself, which is the common case.
- Local tenant — which tenant these users belong to.
- Access mode — controls whether sign-in is permitted at all.
Giving the identity provider what it needs
ActiveManage publishes its own SAML metadata. Send that address to the identity provider's administrator and they can configure their end from it, which avoids a great deal of copying and pasting.
Multi-tenant installations
SAML settings are deliberately not copied into new tenants. Cloning one organisation's identity trust settings into another would be a serious mistake, so each tenant configures its own.
Common problems
- Certificate mismatch — the certificate here must be the current one at the identity provider. Certificates expire and get rotated, usually without anyone telling you.
- Nothing happens after sign-in — check the access mode permits it.
- Users arrive with no name or address — the attribute mappings do not match what the provider actually sends. Ask them for a sample assertion.
Worked Examples
- Enterprise customer onboarding: one SAML provider row per customer, each pointed at their own tenant.
- Internal Entra ID: SAML or Azure AD both work; Azure AD is usually less configuration.