# Single Sign-On Configuration (SAML)

In this section, we'll go through the steps of setting up **SAML (Security Assertion Markup Language)** for your Softr app. SAML is an open standard that allows **identity providers (IdP)** to pass authorization credentials to **service providers (SP)**, so that users can use a single set of credentials to log into different SPs. In this case your Softr app is the **SP**, and you need to connect it to an IdP to implement **Single Sign-On (SSO)** on your Softr app. There are several IdP services (e.g. Azure, Okta, Box) that you can use, but here we'll demonstrate the setup flow using [OneLogin](https://www.onelogin.com/). So, let's start.

## Creating an Application on IdP

From the OneLogin dashboard, we are going to navigate to **Applications** and click **Add App**.

![Adding an application](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhDkxXOV_qBCdgL8oXr%2F-MhDxWsZ6XQ2xI5UNuv2%2Fadd%20app-b.png?alt=media\&token=d3cfaa29-8304-4a1a-9aaf-9b7c96870bee)

In the list that opens next, search for "saml test connector," select it, and create the application.

![SAML Test Connector](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhDkxXOV_qBCdgL8oXr%2F-MhDzZue-KoOaOiO_bBZ%2Fsaml-connector-b.png?alt=media\&token=61e09016-9d8a-4110-92e4-8fe5683ffa36)

## Configuring the Application

In the Application settings, we are going to navigate to **Configuration** and fill in the following fields:

* **Audience (EntityID)**
* **Recipient**
* **ACS (Consumer) URL Validator**
* **ACS (Consumer) URL**

To do this, you need to navigate to your Softr app's **Settings => SAML Integration**. From there, copy the **ACS URL** and paste into **Recipient** and **ACS (Consumer) URL\*** fields as well as copy the **Audience URL** and paste into the **Audience (EntityID)** field. In the **ACS (Consumer) URL Validator** field, just add "**.\***".&#x20;

![SAML Settings in your Softr app](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhE-43eq2EfCAzvUT5r%2F-MhE1VNFC474jsyD-0Ns%2Fsettings-b.png?alt=media\&token=cf43f4ce-7ed7-47a1-8642-5492f22e299c)

So, the **ACS URL** is basically your application SAML URL, while the **Audience URL** is a unique identifier that allows the IdP to identify the SP. Eventually, your setup should look similar to what's shown below.

![Configuration section setup](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhE-43eq2EfCAzvUT5r%2F-MhE1vF1xCaA4fjpHoEA%2Fconfig-final-b.png?alt=media\&token=4d9ed716-5003-46a6-882f-752601370940)

## Configuring Application Parameters

As soon as you're done with the **Configuration** section, navigate to application's **Parameters**, where you need to create the **Email**, **First Name**, and **Last Name** fields. In the pop-up that opens after clicking the Create button, you need to add the field name (can be anything) and check the **Include in SAML assertion** flag.

![New Field](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhE35io2Qoecifg_3Gh%2F-MhECGkHHK7_Faj_BSIV%2Femail-field-b.png?alt=media\&token=152cee02-3330-4946-8db3-fc9443a3613f)

Then hit **Save** and choose the field's value ("Email," "First Name," or "Last Name" depending on which one you're configuring).&#x20;

![Field's Value](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhE35io2Qoecifg_3Gh%2F-MhED7wtwLATS2XsxkF6%2Femail-value-b.png?alt=media\&token=5f71d457-d1f0-41ff-aa9a-9565d3d2fe42)

In the screenshot below, we already have all the three fields added.

![Field added](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhE35io2Qoecifg_3Gh%2F-MhEDUniqup0q45oUJvy%2Ffields-added-b.png?alt=media\&token=d51e2e15-95ef-453c-9ebb-a77f312baefa)

## Getting the Metadata XML

Further on, navigate to the **SSO** section and copy the **Issuer URL**. As soon as you paste it in the browser address bar, it will download a metadata XML file, which we are going to use in the next step.

![Issuer URL](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhEEQjO8rRTPoujEclk%2F-MhEFo3nSqlYkCYpcNVX%2Fissuer-url-b.png?alt=media\&token=1f1aafc8-7c48-4695-b81c-7445aca0a067)

## Configuring Single Sign-On in Your Softr App

Now that you have everything ready, go to your Softr app's **SAML Settings** and fill in the Metadata.xml field with the XML you downloaded in the previous steps and the key fields with the names of the fields we defined [earlier](#configuring-application-parameters).&#x20;

![SAML Settings Configured](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhEEQjO8rRTPoujEclk%2F-MhEHwJ89fU6k9lfOmBL%2FSAML-config-b.png?alt=media\&token=6e3b7700-54d7-427d-8a40-864ded4054a9)

## Adding the Single Sign-On Block

That's it, you're all set and can now add the **Single Sign-on** block from **Blocks => User Accounts** to allow your users to log in with their IdP (in this case OneLogin) credentials.

![Single Sign-On block](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhEIhALPJoU7yoSRAjl%2F-MhEOkgUJ9KMBi2f-Azo%2Fsignle-sign-on-block-b.png?alt=media\&token=7337fae9-89ed-4038-83cb-9974eb18191a)

You can customize the Logo, Title, Page after signin, and other settings and publish your app. Now, all the users that have an account on your OneLogin application, will be able to log in to your Softr app, and a user will be created for them. See below.

![Logging in with OneLogin account](https://3426011356-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M0NiyhsmXAcV5u1c6XK%2F-MhEPm3cl1qH67O-ieE9%2F-MhERDvu5gtVd9yHzjzY%2Fsaml-login.gif?alt=media\&token=c28dea23-8c86-4b57-8204-91cbaf7d4996)
