https://incisio.net/assets/saml-sso-setup-CVjw-mxW.js

1import{j as e,p as h,d as s,w as d,ap as m,x as l,C as i,b as t,c as r,l as c,q as a,e as n,aP as x,aA as o,E as u}from"./index-CKvMJGt9.js";function p(){return e.jsxs("div",{className:"max-w-4xl mx-auto space-y-8",children:[e.jsxs("div",{className:"space-y-4",children:[e.jsxs("div",{className:"flex items-center gap-3",children:[e.jsx(h,{className:"h-8 w-8 text-blue-600"}),e.jsxs("div",{children:[e.jsx("h1",{className:"text-3xl font-bold",children:"SAML SSO Setup Guide"}),e.jsx("p",{className:"text-lg text-muted-foreground",children:"Complete guide to configure SAML 2.0 single sign-on authentication"})]})]}),e.jsxs("div",{className:"flex gap-2",children:[e.jsx(s,{variant:"secondary",children:"SAML 2.0"}),e.jsx(s,{variant:"secondary",children:"Enterprise"}),e.jsx(s,{variant:"secondary",children:"Security"})]})]}),e.jsxs(d,{children:[e.jsx(m,{className:"h-4 w-4"}),e.jsx(l,{children:"SAML SSO allows users to authenticate using your organization's identity provider (IdP) such as Active Directory, Okta, Azure AD, or JumpCloud."})]}),e.jsxs("div",{className:"grid gap-6",children:[e.jsxs(i,{children:[e.jsxs(t,{children:[e.jsxs(r,{className:"flex items-center gap-2",children:[e.jsx(c,{className:"h-5 w-5"}),"Prerequisites"]}),e.jsx(a,{children:"Before configuring SAML SSO, ensure you have the following:"})]}),e.jsx(n,{className:"space-y-3",children:e.jsxs("div",{className:"grid gap-2",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),e.jsx("span",{children:"Admin access to your identity provider (IdP)"})]}),e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),e.jsx("span",{children:"Organization admin role in the platform"})]}),e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),e.jsx("span",{children:"Your organization's SAML metadata or configuration details"})]}),e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),e.jsx("span",{children:"Valid SSL certificate for your domain"})]})]})})]}),e.jsxs(i,{children:[e.jsxs(t,{children:[e.jsx(r,{children:"Step 1: Configure SAML in Platform"}),e.jsx(a,{children:"Set up the SAML integration in your organization settings"})]}),e.jsxs(n,{className:"space-y-4",children:[e.jsxs("div",{className:"space-y-3",children:[e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("div",{className:"bg-blue-100 text-blue-700 rounded-full w-6 h-6 flex items-center justify-center text-sm font-medium",children:"1"}),e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Navigate to Organization Settings"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Go to Settings → Integrations → SAML SSO"})]})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("div",{className:"bg-blue-100 text-blue-700 rounded-full w-6 h-6 flex items-center justify-center text-sm font-medium",children:"2"}),e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:'Click "Configure Now"'}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"This will open the SAML configuration form"})]})]})]}),e.jsx(x,{}),e.jsxs("div",{className:"space-y-4",children:[e.jsx("h4",{className:"font-semibold",children:"Required Configuration Fields:"}),e.jsxs("div",{className:"space-y-3",children:[e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Entity ID"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Unique identifier for your SAML configuration"})]}),e.jsx(s,{variant:"outline",children:"Required"})]}),e.jsx("div",{className:"mt-2 p-2 bg-gray-50 rounded text-sm font-mono",children:"incisio-saml-sp"})]}),e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"SSO URL"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"The SAML SSO URL provided by your identity provider"})]}),e.jsx(s,{variant:"outline",children:"Required"})]}),e.jsx("div",{className:"mt-2 p-2 bg-gray-50 rounded text-sm font-mono",children:"https://sso.jumpcloud.com/saml2/nsa_demo"})]}),e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Assertion Consumer Service (ACS) URL"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"URL where SAML assertions are sent after authentication"})]}),e.jsx(s,{variant:"outline",children:"Required"})]}),e.jsx("div",{className:"mt-2 p-2 bg-gray-50 rounded text-sm font-mono",children:"https://incisio.net/api/auth/saml/565646db-b53c-4e2b-94c9-45b50b0af5d5/assert"})]}),e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Email Domain"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Users with email addresses from this domain will be redirected to SSO"})]}),e.jsx(s,{variant:"outline",children:"Required"})]}),e.jsx("div",{className:"mt-2 p-2 bg-gray-50 rounded text-sm font-mono",children:"incisio.net"})]}),e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"IDP Metadata"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"XML metadata from your identity provider"})]}),e.jsx(s,{variant:"outline",children:"Optional"})]}),e.jsx("div",{className:"mt-2 p-2 bg-gray-50 rounded text-sm",children:"Paste the complete XML metadata from your IdP here"})]})]})]})]})]}),e.jsxs(i,{children:[e.jsxs(t,{children:[e.jsx(r,{children:"Step 2: Advanced Configuration"}),e.jsx(a,{children:"Configure additional SAML settings for enhanced 

1security and functionality"})]}),e.jsx(n,{className:"space-y-4",children:e.jsxs("div",{className:"space-y-4",children:[e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("p",{className:"font-medium",children:"Enforce SSO"}),e.jsx(s,{variant:"secondary",children:"Security"})]}),e.jsx("p",{className:"text-sm text-muted-foreground mb-2",children:"Require all users from this domain to use SSO authentication"}),e.jsxs(d,{children:[e.jsx(c,{className:"h-4 w-4"}),e.jsx(l,{children:"Enable this only after verifying SSO works correctly to avoid account lockouts"})]})]}),e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("p",{className:"font-medium",children:"Just-in-Time (JIT) Provisioning"}),e.jsx(s,{variant:"secondary",children:"Automation"})]}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Automatically create user accounts when they first log in via SSO"})]}),e.jsxs("div",{className:"border rounded-lg p-3",children:[e.jsx("p",{className:"font-medium mb-2",children:"Role Mapping Configuration"}),e.jsxs("div",{className:"space-y-2",children:[e.jsxs("div",{className:"text-sm",children:[e.jsx("span",{className:"font-medium",children:"Role Attribute:"}),e.jsx("span",{className:"ml-2 font-mono bg-gray-100 px-2 py-1 rounded",children:"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role"})]}),e.jsxs("div",{className:"text-sm",children:[e.jsx("span",{className:"font-medium",children:"Default Role:"}),e.jsx("span",{className:"ml-2 font-mono bg-gray-100 px-2 py-1 rounded",children:"user"})]})]})]})]})})]}),e.jsxs(i,{children:[e.jsxs(t,{children:[e.jsx(r,{children:"Step 3: Configure Your Identity Provider"}),e.jsx(a,{children:"Set up the SAML application in your IdP using the platform's service provider details"})]}),e.jsxs(n,{className:"space-y-4",children:[e.jsxs(d,{children:[e.jsx(c,{className:"h-4 w-4"}),e.jsx(l,{children:"The exact steps vary by identity provider. Below are general guidelines that apply to most IdPs."})]}),e.jsxs("div",{className:"space-y-4",children:[e.jsxs("div",{className:"space-y-3",children:[e.jsx("h4",{className:"font-semibold",children:"Service Provider Configuration"}),e.jsxs("div",{className:"grid gap-3",children:[e.jsxs("div",{className:"flex justify-between items-center p-3 bg-gray-50 rounded",children:[e.jsxs("div",{children:[e.jsx("span",{className:"font-medium",children:"ACS URL:"}),e.jsx("span",{className:"ml-2 text-sm font-mono",children:"https://your-domain.com/api/auth/saml/callback"})]}),e.jsx(o,{className:"h-4 w-4 text-gray-500 cursor-pointer"})]}),e.jsxs("div",{className:"flex justify-between items-center p-3 bg-gray-50 rounded",children:[e.jsxs("div",{children:[e.jsx("span",{className:"font-medium",children:"Entity ID:"}),e.jsx("span",{className:"ml-2 text-sm font-mono",children:"incisio-saml-sp"})]}),e.jsx(o,{className:"h-4 w-4 text-gray-500 cursor-pointer"})]}),e.jsxs("div",{className:"flex justify-between items-center p-3 bg-gray-50 rounded",children:[e.jsxs("div",{children:[e.jsx("span",{className:"font-medium",children:"Name ID Format:"}),e.jsx("span",{className:"ml-2 text-sm font-mono",children:"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"})]}),e.jsx(o,{className:"h-4 w-4 text-gray-500 cursor-pointer"})]})]})]}),e.jsx(x,{}),e.jsxs("div",{className:"space-y-3",children:[e.jsx("h4",{className:"font-semibold",children:"Required SAML Attributes"}),e.jsxs("div",{className:"space-y-2",children:[e.jsxs("div",{className:"flex justify-between p-2 border rounded",children:[e.jsx("span",{className:"font-medium",children:"Email"}),e.jsx("span",{className:"text-sm font-mono",children:"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"})]}),e.jsxs("div",{className:"flex justify-between p-2 border rounded",children:[e.jsx("span",{className:"font-medium",children:"First Name"}),e.jsx("span",{className:"text-sm font-mono",children:"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"})]}),e.jsxs("div",{className:"flex justify-between p-2 border rounded",children:[e.jsx("span",{className:"font-medium",children:"Last Name"}),e.jsx("span",{className:"text-sm font-mono",children:"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"})]}),e.jsxs("div",{className:"flex justify-between p-2 border rounded",children:[e.jsx("span",{className:"font-medium",children:"Role (Optional)"}),e.jsx("span",{className:"text-sm font-mono",children:"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role"})]})]})]})]})]})]}),e.jsxs(i,{children:[e.jsxs(t,{children:[e.jsx(r,{children:"Step 4: Testing Your Configuration"}),e.jsx(a,{children:"Verify that SAML SSO is working correctly before enabling for all users"})]}),e.jsxs(n,{className:"space-y-4",children:[e.jsxs("div",{className:"space-y-3",children:[e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("div",{className:"bg-green-100 text-green-700 rounded-full w-6 h-6 flex items-center justify-center text-sm font-medium",children:"1"}),e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Test SSO Discovery"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Go to the login page and enter an email from your configured domain. You should be redirected to your identity provider."})]})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("div",{className:"bg-green-100 text-green-700 rounded-full w-6 h-6 flex items-center justify-center text-sm font-medium",children:"2"}),e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Complete Authentication"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Log in through your IdP and verify you're redirected back to the platform successfully."})]})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("div",{className:"bg-green-100 text-green-700 rounded-full w-6 h-6 flex items-center justify-center text-sm font-medium",children:"3"}),e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Verify User Attributes"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Check that user profile information (name, email, role) is correctly populated from SAML attributes."})]})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("div",{className:"bg-green-100 text-green-700 rounded-full w-6 h-6 flex items-center justify-center text-sm font-medium",children:"4"}),e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"Test JIT Provisioning"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"If enabled, verify that new users are automatically created with appropriate roles and permissions."})]})]})]}),e.jsxs(d,{children:[e.jsx(m,{className:"h-4 w-4"}

1),e.jsx(l,{children:'Once testing is complete and successful, you can enable "Enforce SSO" to require all domain users to authenticate via SAML.'})]})]})]}),e.jsxs(i,{children:[e.jsxs(t,{children:[e.jsx(r,{children:"Troubleshooting Common Issues"}),e.jsx(a,{children:"Solutions to frequently encountered SAML SSO configuration problems"})]}),e.jsxs(n,{className:"space-y-4",children:[e.jsxs("div",{className:"space-y-4",children:[e.jsxs("div",{className:"border-l-4 border-red-500 pl-4",children:[e.jsx("p",{className:"font-medium text-red-700",children:"SAML Response Invalid"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Check that your IdP is using the correct ACS URL and Entity ID. Verify XML signatures and certificates."})]}),e.jsxs("div",{className:"border-l-4 border-yellow-500 pl-4",children:[e.jsx("p",{className:"font-medium text-yellow-700",children:"User Not Found After SSO"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Enable JIT provisioning or ensure users exist in the platform before their first SSO login."})]}),e.jsxs("div",{className:"border-l-4 border-blue-500 pl-4",children:[e.jsx("p",{className:"font-medium text-blue-700",children:"Incorrect User Attributes"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Verify that your IdP is sending the required SAML attributes with the correct claim names."})]}),e.jsxs("div",{className:"border-l-4 border-purple-500 pl-4",children:[e.jsx("p",{className:"font-medium text-purple-700",children:"SSO Not Triggered"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Check that the email domain exactly matches your configuration and there are no typos."})]})]}),e.jsxs("div",{className:"mt-6 p-4 bg-blue-50 rounded-lg",children:[e.jsxs("div",{className:"flex items-center gap-2 mb-2",children:[e.jsx(u,{className:"h-4 w-4 text-blue-600"}),e.jsx("span",{className:"font-medium text-blue-800",children:"Need Additional Help?"})]}),e.jsx("p",{className:"text-sm text-blue-700",children:"For advanced configuration assistance or troubleshooting complex issues, contact your system administrator or check your identity provider's documentation for SAML integration specifics."})]})]})]})]})]})}export{p as default};