Add a SAML Provider
Use the Add Provider action to connect a SAML 2.0 identity provider, so users can sign in to Qualytics with their corporate identity. The configuration fields can be filled in automatically from your identity provider's metadata URL or metadata file.
Permissions
Only users with the Admin role can manage sign-in providers. See the Permissions page for details.
Before You Start: Register Qualytics in Your IdP
The provider form shows the two values your identity provider needs, each with a copy button:
| Value | Description |
|---|---|
| Assertion Consumer Service (ACS) URL | The endpoint where your identity provider sends the SAML assertion. |
| SP Entity ID | Qualytics's service provider identifier. |
On a saved provider, you can also click Download SP Metadata to hand your identity provider a metadata file, or Copy Metadata URL to give it the metadata endpoint directly.
Fields
General
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Display Name | Required. The name shown to users on the sign-in page. |
| 2 | Identity provider values | The ACS URL and SP Entity ID to register in your identity provider's SAML application (see Before You Start above). |
Identity Provider
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Import from metadata XML file | Fills in the fields below from the metadata file downloaded from your identity provider. |
| 2 | IdP Metadata URL | Your identity provider's metadata endpoint. Providing it fills in the fields below automatically, with the same result as the file import. |
| 3 | IdP Entity ID | Your identity provider's entity identifier. |
| 4 | SSO URL | Required. The identity provider's single sign-on URL. |
| 5 | SLO URL | The identity provider's single logout URL. |
| 6 | X.509 Certificate | Required. The identity provider's signing certificate. Stored securely and never displayed again; paste it again only to replace it. |
| 7 | Name ID Format | Required. The subject identifier format: Unspecified, Email Address (default), Persistent, or Transient. |
| 8 | Signed assertions | Requires the identity provider to cryptographically sign SAML assertions. On by default; disabling it asks for an explicit confirmation because unsigned responses can be tampered with. |
| 9 | Session Duration | Required. How long a Qualytics session remains valid after sign-in, in minutes, between 5 and 1440 (default 480, which is 8 hours). |
Service Provider Metadata
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | SP Entity ID | Overrides the service provider entity ID advertised to the identity provider. Leave empty to use the metadata URL shown in the form. |
Attribute Mapping
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | SAML Attribute Mapping | Maps Qualytics user fields to the SAML attribute names your identity provider emits. The supported fields are subject_id, email, and name. Leave the mapping empty to use the provider defaults. |
Access Restriction
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Groups Claim | The SAML attribute name that contains the user's group memberships. |
| 2 | Allowed Groups | Only users in these groups can sign in. Leave empty to allow all users. |
| 3 | Allowed Email Domains | Only users with an email in these domains can sign in. Leave empty to allow all domains. |
Provisioning and Linking
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Automatic user provisioning | Creates a Qualytics user after a successful sign-in when the identity is not linked to an account yet. On by default. |
| 2 | Cross-provider account linking | Allows an identity from this provider to request linking to an existing account with the same email. On by default. |
| 3 | Require administrator approval | Keeps newly proposed cross-provider links pending until an administrator approves them in Link approvals. Off by default, so links are created without review unless you turn it on. |
Advanced SAML Security
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Allow unsolicited SAML responses | Accepts sign-ins initiated from the identity provider's own portal, without a matching Qualytics authentication request. Off by default; enable it only when your identity provider is trusted and requires this flow. |
Info
For how provisioning, linking, and restrictions behave at sign-in, see How It Works.
Steps
Step 1: Click the Add Provider button in the Providers tab, or select Provider from the Add menu in the top right corner.
Step 2: The Add Provider modal appears.
Step 3: Select SAML 2.0 as the provider type.
Step 4: Fill in the provider fields (see Fields above).
Step 5: Click the Test button and review the results.
Step 6: Click the Create button. A success message appears and the provider is listed in the Providers tab.
