---
description: Standard setup for federated SSO using SAML
---

# SAML SSO Setup

## Access the Netacea Portal <a href="#step-1-copy-audience-uri-and-reply-url" id="step-1-copy-audience-uri-and-reply-url"></a>

Access the Netacea Portal as an Admin user using your Username and Password Account.

* [https://portal.netacea.com/user-management/single-sign-on](https://portal.netacea.com/user-management/single-sign-on)

If the page indicates Single Sign On is disabled, please contact our support team to setup access.

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2F2jhC7IHIWwyXbilJ0bTI%2Fimage.png?alt=media&#x26;token=d0d86918-c948-45df-8f2c-8be0abc03b44" alt=""><figcaption><p>SSO is Disabled by default, contact support in the first instance!</p></figcaption></figure>

## SSO Enabled <a href="#step-1-copy-audience-uri-and-reply-url" id="step-1-copy-audience-uri-and-reply-url"></a>

### Download App Icon and copy App Name, Audience URI and Reply URL <a href="#step-1-copy-audience-uri-and-reply-url" id="step-1-copy-audience-uri-and-reply-url"></a>

From the Sign Sign On page - download the **App Icon** and copy the **App Name**, **Audience URI** and **Reply URL** - these values will be needed to set up the SAML Application in your Customer’s IdP

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2F0RizAaWKZ8O9hiaWy7yf%2Fimage.png?alt=media&#x26;token=755f9ee4-e824-434d-aa91-ba6fa77e8050" alt=""><figcaption><p>Download App Icon and copy App Name, Audience URI and Reply URL in to your IdP Application</p></figcaption></figure>

### Create an Enterprise Application / App Integration <a href="#step-2-create-an-enterprise-application-app-integration" id="step-2-create-an-enterprise-application-app-integration"></a>

In your organisation's IdP, create a new Netacea App integration.

We have two guides available for demonstration:

* [Netacea SSO with Microsoft Entra ID](entra-id-sso-setup) - “Create Enterprise Application”
* [Netacea SSO with Okta ](okta-sso-setup)- “Create App Integration”

{% hint style="info" %}
Check out the [FAQs ](sso-faqs)for answers to some common issues
{% endhint %}

Netacea have provided guides for [**Microsoft Entra ID**](entra-id-sso-setup) and [**Okta** ](okta-sso-setup)as two common Identity Providers.

The setup details for these Identity Providers should be broadly similar to the examples provided. Reach out to our support team if you are unable to create a correct configuration.

#### Associate Users with Application <a href="#step-2.1-associate-users-with-application" id="step-2.1-associate-users-with-application"></a>

By default, the new application will have no users associated.

Assign one or more users to your IdP Application so that a sign in attempt can be tested at the end of the process. With SSO enabled your organisation is in control of who can and can't access the Netacea Portal.

Additionally we support [IP Restrictions](../ip-restriction) for VPNs if you need additional controls.

### Register Application Details with Netacea Portal <a href="#step-3-register-application-details-with-netacea-portal" id="step-3-register-application-details-with-netacea-portal"></a>

Once you've created an identity application for Netacea in your IdP - there are several details that we require to setup the integration.

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2FnA6BAVnzFXOXjR0Wl6P5%2Fimage.png?alt=media&#x26;token=1d5908cb-c62c-4c24-a64f-d41c3d72fdd6" alt=""><figcaption></figcaption></figure>

#### Metadata URL <a href="#step-3.1-enter-required-fields" id="step-3.1-enter-required-fields"></a>

Provide the Metadata URL or Upload Metadata File (XML) for the IdP Application.&#x20;

#### IdP Identifier <a href="#step-3.1-enter-required-fields" id="step-3.1-enter-required-fields"></a>

By default the IdP identifier will be the subdomain that you are logged in as.

For example an Admin user logged in `joe.bloggs@example.com` will set the value `example.com` .

If you require multiple domain identifiers; e.g. supporting `example.uk` and `example.com` email addresses on the same account, please contact Netacea’s support team to verify ownership of the second domain.

#### Specify Attribute Mappings <a href="#step-3.2-specify-attribute-mappings" id="step-3.2-specify-attribute-mappings"></a>

Map attributes between your IdP and Netacea Atlas Portal. For example, if your Identity Provider includes a "surname" attribute, you should match this to the "Family Name" attribute in Netacea User Pool.

Examples shown in table below.

| User Pool Attribute (Netacea / AWS Cognito) | SAML Attribute (Microsoft Entra ID) |
| ------------------------------------------- | ----------------------------------- |
| Given Name Attribute                        | name                                |
| Family Name Attribute                       | surname                             |
| Email Address Attribute                     | emailaddress                        |

These data mappings are used to correctly display usernames, send portal notifications to associated email addresses, and are used in Netacea’s Audit Trail feature to identify which actions were taken by who and when. User mappings are created automatically when a user logs into the Netacea Portal via SSO - and can be removed either by request, or through the User Management section of Netacea’s Portal.

#### Save Draft and Apply Changes <a href="#step-3.4-save-and-apply" id="step-3.4-save-and-apply"></a>

Changes must be saved as a draft and validated before applying a new configuration.

Use the `Save Draft` and `Apply` buttons to enact your changes ready for testing.

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2F68z3xh1FvyKVAyrypVcl%2Fimage.png?alt=media&#x26;token=08ec80d8-6b0e-4731-b111-5422756c45e6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2FRs23E7IhQHxxXiWlXrJB%2Fimage.png?alt=media&#x26;token=e3ed0f7e-f823-4892-937e-057351ab25aa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2FhZFBgRAVnEbi7xvBbZtI%2Fimage.png?alt=media&#x26;token=b878930f-2f14-4d1a-979f-44fbe89d0cf0" alt=""><figcaption></figcaption></figure>

## Testing <a href="#step-4-test-sign-in" id="step-4-test-sign-in"></a>

Visit [https://portal.netacea.com](https://portal.netacea.com) and attempt to sign in using a valid user associated with your IdP.

<figure><img src="https://2843832198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FznjHsCCFk9N601bmryTK%2Fuploads%2FMDt9dvDOCOezHPueIHtS%2Fimage.png?alt=media&#x26;token=22ce68ec-5421-4cfd-8bce-ef6cfa36c32d" alt=""><figcaption></figcaption></figure>

A valid login should redirect to your organisation's Identity Provider, where you can authenticate as per your organisation's security requirements, before being returned to the Netacea Portal.
