Single Sign On

Integrate your enterprise login service with Noloco

Single sign on is a feature available for ENTERPRISE plans on Noloco. Enabling it will disable all other login and sign up features, requiring your users to login with their enterprise credentials. To enable SSO navigate to your login options and configure the integration.

SAML

We support SAML 2.0 as a method of SSO in Noloco. To use SAML as a method of login you need to provide us with information about your Identity Provider (IdP) and in turn we will provide you information to set us up as a Service Provider.

Add a SAML integration

To setup a SAML integration click Configure next to it in the login settings.

You will then see a form open within a modal for you to complete:

This form contains four sections:

1. Noloco's callback URL for SAML responses

2. Metadata about your IdP

3. Attribute mappings for SAML responses

4. Noloco role settings

Callback URL

This URL is where your IdP should POST SAML responses to after your users login. You can copy the URL to your clipboard using the button provided and it is likely you will have to whitelist it in your IdP.

IdP metadata

We require the following metadata about your IdP to be able to properly configure your SAML integration:

1. The URL we can contact your IdP at

2. The public certificate we can use to verify responses from your IdP

3. The issuer for requests that your IdP expects

The easiest way to configure your SAML integration is by uploading the metadata XML file that your IdP provides to you. You can drag and drop this onto the file dropzone in this form. Alternatively you can expand the configuration section and manually complete it.

Attribute mapping

We need to know how to build Noloco users from your SAML responses, you can configure this by telling us the attribute names that correspond to each Noloco user field. There are a few places you can look these up. Firstly you might be able to find them in your IdP settings for SAML, e.g. in Auth0 we can see the following in our Settings:

{
  ...
  "mappings": {
    "user_id":     "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
    "email":       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "name":        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "given_name":  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
    "family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
    "upn":         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn",
    "groups":      "http://schemas.xmlsoap.org/claims/Group"
  },
  ...
}

This tells us that the name of the email attribute is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress so we would copy this entire value into the Email Address Attribute input in the configuration form.

Alternatively you might be able to find these in your metadata XML file that you uploaded for the configuration. For the same example we can see the email attribute:

Note that presently we do not automatically detect attribute mappings so even if they are in your metadata XML file you will have to input them yourself.

Noloco role

Finally you can select a default role that all users will be assigned when they first sign into your app with SAML.

Your existing SAML integration

You can review your existing SAML integration from the login settings page where we will show you the IdP and any mapped attributes.

You can update the integration by clicking on it and changing the values in the same form that you saw at setup.

To remove the SAML integration click the Remove button and confirm your choice in the modal that will appear.

How your users login

When your users try to log into your app, they will be redirected to the /login page where they will see a redirect out to your IdP.

The /register, /join and /forgot pages will all now also redirect to this login page.

After clicking the sign in button they will be taken to your enterprise login page where they will go through your in-house login flow. After that they will be redirected back to your Noloco app (where if they are new to the app a new user record will be created for them).

Troubleshooting

I'm using Auth0 for my IdP and see "Unauthorized" after logging in

By default Auth0 is set up to sign the assertions on SAML responses but not sign the entire response. For security reasons we will only accept SAML responses which have a top-level document signature we can verify.

You can configure Auth0 to sign the entire response by going to Applications > [Your Application] > Addons > SAML2 Web App > Settings and making sure that the settings JSON includes a (uncommented) line with "signResponse": true. For example:

I'm using Azure Active Directory for my IdP and see a AADSTS700016 error during the Microsoft login flow

This error means that the Issuer (entity ID) configured in your Noloco SAML settings does not match the Identifier (Entity ID) in your Azure Active Directory settings. You can find more information about resolving this error here.

I'm using Azure Active Directory for my IdP and see "Unauthorized" after logging in

By default Azure Active Directory is set up to sign the assertions on SAML responses but not sign the entire response. For security reasons we will only accept SAML responses which have a top-level document signature we can verify.

Follow the instructions here to configure Azure Active Directory to sign either the response or both the response and the assertions.