Skip to content

SSO Setup

Purpose

Single Sign On (SSO) enables centralized identity and secure user access for SailPoint Entro tenants. This document covers SAML SSO setup, validation, and troubleshooting. Keep one master page and link to vendor deep-dives for complex IdPs.

Supported IdP Platforms

  • Auth0

  • Azure Entra ID

  • Classlink

  • CyberArk

  • Descope

  • Duo

  • Google Workspace

  • JumpCloud

  • Keycloak

  • LastPass

  • Microsoft ADFS

  • miniOrange

  • Okta

  • OneLogin

  • PingFederate / PingOne

  • Salesforce

  • Keep one master SSO page for overview, standard templates, validation, and troubleshooting.

  • Create separate per-IdP deep-dive pages only for IdPs that require step-by-step vendor-specific commands (e.g., Okta, Azure Entra, OneLogin).

  • Master page contains quick links to vendor pages and common troubleshooting.

Suggested filenames:

  • SSO_Setup.md (master)

  • SSO_Okta.md (Okta deep-dive)

  • SSO_Azure_Entra_ID.md (Azure Entra deep-dive)

  • SSO_OneLogin.md (OneLogin deep-dive)

Quick Overview of Steps

  1. Request SSO support from SailPoint Entro Support.

  2. SailPoint Entro Support provides a unique setup link or SP metadata.

  3. Configure your IdP using SailPoint Entro-provided metadata.

  4. Share IdP metadata/certificate and all user domains with SailPoint Entro Support.

  5. SailPoint Entro Support enables SSO for your tenant and confirms activation.

  6. Test login and confirm user-domain mappings.

SSO is not active for the tenant until SailPoint Entro completes the step where they add IdP metadata/certificates and enable SSO.

SailPoint Entro Onboarding Form Fields (What Support Will Ask You)

  • Provider name (e.g., Okta)

  • IdP metadata URL or XML (or uploaded metadata file)

  • IdP x.509 certificate (PEM)

  • Entity ID (IdP)

  • Allowed user domains (e.g., corp.example.com)

  • Default relay/ACS URL (provided by SailPoint Entro Support)

  • Single Logout URL (optional)

  • Enforce SSO (yes/no)

SAML Configuration Template (IdP-side)

  • Entity ID (SP): provided by SailPoint Entro Support

  • ACS (Assertion Consumer Service) URL: provided by SailPoint Entro Support

  • Single Logout URL: optional

  • NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

  • Required attributes:

    • email (primary, used for account mapping)

    • givenName or firstName

    • familyName or lastName

    • groups (optional, for group-based access)

  • Certificate: x.509 PEM for signing assertions

Tell the IdP team to send either the full metadata XML or the metadata URL.

ASCII Architecture

User Browser
    |
    v
IdP (Authn)  <----->  Entro SSO Endpoint (ACS / Metadata)
    |                         |
    v                         v
Entro Platform (User mapping, session issuance, RBAC)

Validation & Testing

  1. SailPoint Entro Support enables SSO for your tenant.

  2. From a private/incognito browser, open your tenant SSO URL and choose the IdP option.

  3. Observe IdP login flow and redirection to SailPoint Entro.

  4. Confirm SailPoint Entro side checks:

    • SSO logs show assertion received and mapped email.

    • Status: Verified in onboarding checklist.

  5. Use SAML tracer tools to inspect assertion and timestamps.

Common Errors and Resolutions

  • Certificate mismatch / invalid signature: Ensure IdP x.509 cert matches metadata.

  • Time skew / invalid NotBefore or NotOnOrAfter: Sync clocks via NTP. Tolerance 120s.

  • NameID or attribute mismatch: Confirm attribute names. Map email attribute to primary email.

  • Domain not allowed: Share all user domains with SailPoint Entro Support and add to allow-list.

  • SAML response encrypted but SailPoint Entro not configured for encryption: Disable encryption or provide SP decryption info.

  • Logout not working: Confirm Single Logout endpoints and certificates.

Advanced Diagnostics

  • Capture SAML request/response with SAML tracer.

  • Check IdP audit logs for delivered assertions.

  • Verify SailPoint Entro SSO logs show assertion_id, email, and status=success.

  • If using groups, validate attribute format and mapping.

Security & Compliance Notes

  • Assertions must be signed.

  • Transport via TLS only.

  • Enforce SSO per-tenant only after verification.

  • Maintain least-privilege access for delegated service accounts.

Troubleshooting Commands/snippets

Metadata URL example:

https://<your-idp>/saml/metadata

Verify metadata contains x.509 cert and ACS endpoints.

Time skew check (example):

ntpstat

Or check NTP service status on the IdP host.

Roles and Group Mapping

  • Example mapping:

    • IdP group ent-ops → SailPoint Entro role Admin

    • IdP group ent-dev → SailPoint Entro role Developer

Send CSV or JSON mapping to SailPoint Entro Support for bulk mapping.

Support Contact

  • support@entro.security — include tenant name, IdP metadata, x.509 cert, failing assertion trace, test time and user email.