SAML 2.0 SSO (Advanced)

← Back to SAML section

• Availability
  • Plan: Advanced
• Roles and Permissions
  • Admins only

To setup SAML based SSO you’ll need to be an admin and be subscribed to either Advanced, Performance or Enterprise packages. This document does assume you are familiar with setting up SAML 2.0 SSO.

The process starts with creating a SAML 2.0 connector/application within your identity provider and then creating a corresponding integration in ProdPad.

SAML SSO allows you to set up a direct link from your identity provider dashboard to ProdPad, depending on your provider. This will allow users to log in to ProdPad without having to enter a password in ProdPad.

SAML SSO / ProdPad link supports the following capabilities:

• Login from the identity provider dashboard into ProdPad.
• The user can also login to ProdPad if they go to https://app.prodpad.com/ via you identity provider.
• Just-in-time provisioning: if a user has never logged into ProdPad before and they click on the ProdPad app in the dashboard, a role will be created for them in your account. The role will have a reviewer type unless the role attribute is configured.
• For Performance and Enterprise accounts, you can set up SCIM so that users are auto-provisioned. See here for steps to set this up.

In ProdPad

1. To start go to Account Settings and select the Security tab.
2. Now select the SSO/SAML sub-tab.
3. Click the "Add authentication type" button and select SAML from the dropdown.

   

4. Keep the modal open (you will need these URLs) and go to your Identity Provider.

In IdP

1. Create a new SAML 2.0 connector.
2. In the field relevant to the SP Entity ID, copy & paste the Audience/Identifier URL from ProdPad (https://api.prodpad.com/api/v2/sso/saml/metadata).
3. In the field relevant to the SAML Audience URL copy & paste the ACS/Reply URL from ProdPad (https://api.prodpad.com/api/v2/sso/saml/acs).
4. If applicable, in the Single Logout URL field paste the Single Logout URL (https://api.prodpad.com/api/v2/sso/saml/sls).
5. In the parameters or claim attributes section of you IdP you will need to map the following:
   1. an attribute with the name NameID mapped to the value of the user's email.
   2. an attribute with the name "User.FirstName" mapped to the value of the user's first/given name.
   3. an attribute with the name "User.LastName" mapped to the value of the user's last/family name.
   4. If you wish to use Just In Time provisioning for roles in ProdPad, an attribute with the name "User.ProdpadRole" mapped to a custom attribute value which should return either 'admin', 'editor' or 'reviewer' (no value will also default the user to reviewer when provisioned).
6. Generate a private & public key and upload the private key to the identity provider as an x.509 certificate.
7. If there is a name or label field add "ProdPad".
8. If there is a tag field then add "prodpad".
9. If there is an option to upload logos so your team can identify this easily, the ProdPad logos are attached at the bottom of this page.
10. Save the connector.

In ProdPad

1. Click the Next button on the SAML modal.
2. Copy into the field labelled "IdP Entity ID/URL" in ProdPad, the unique URL that identifies the IdP/SAML connector in the IdP, this may also be called issuer URL/ID.
3. Copy into the field "IdP SAML Single Sign-On URL" in ProdPad, the audience URL that users should be redirected to when they attempt to login from the login page in ProdPad this will be something like https://sso.idp.com/saml2/prodpad.
4. Copy into the field "Logout URL" in ProdPad, the IdP single logout service endpoint.
5. Paste the text of X.509 certificate (public key generated above) into the X.509 certificate field.
   
   

   

6. Now you must decide whether you want your users to login by IdP initiated login only or by IdP and SP initiated login. If you select IdP only, you user must login from the IdP dashboard, rather than the ProdPad login page. If you opt for IdP & SP initiated login you must set up the Domains that your users can login from, more about this here.
7. If you have opted for IdP only, hit save and you are done! Your users can now use the ProdPad app link on their dashboard.
8. If you have opted for IdP & SP initiated login, from the Domains list select the domain that corresponds to the email address they will be login in from. Note: for a domain to appear as an option here in must be verified under the Domains tab.
9. Hit save.

To test you can now go to the Identity providers console and click on the ProdPad app icon and you’ll be logged into ProdPad. You can then go to to https://app.prodpad.com/login and enter your email. You’ll then be shown a button to login using your IdP.