If your organisation uses an external identity provider (IDP) that supports SAML 2.0, you can configure it as an SSO provider for the Monitor. This lets users sign in using your organisation’s identity provider instead of a Monitor password.

You can create more than one SSO configuration. For example, you can configure one IDP for a parent company and map users to sub-companies, or configure separate IDPs for each sub-company.

Prerequisites

• You have the ecosio Enterprise package (SSO is an Enterprise feature).
• You have administrative access to your SAML identity provider.
• You have the Company admin permission.
• ecosio has enabled SSO for your test instance of the Monitor. You can enable SSO in your production instance when testing is successful.

Set up single sign-on

You must first set up single sign-on in your test instance of the Monitor.

To set up single sign-on:

1. In the Monitor, go to the company settings by doing one of the following:
   • From your user menu, select Company.
   • Select Settings from the sidebar.
2. Select the Security tab.
3. Select Add SAML configuration.
4. Copy the Identifier and Reply-URL.
5. In your identity provider, create a new SAML 2.0 application and add the identifier and reply URL you copied.
6. In the Monitor, select the company you want to configure SSO for.
7. In the External IDP settings section, enter a unique Provider name for the SAML identity provider. The provider name helps you identify the configuration in the Monitor.
8. Enter a domain identifier that can sign in using this SAML provider. Domain identifiers are email domains. The Monitor uses the domain in the user’s email address to route them to the correct SSO provider.
9. (Optional) To add more domains, select Add domain identifier.
10. Enter the Metadata URL from your identity provider. The metadata URL must point to SAML metadata (XML) used to configure the connection between the Monitor and your identity provider.
11. In the Attribute Mapping section, enter the SAML attribute for each field:
    • Email
    • First name
    • Last name Use the claim or attribute names from your identity provider.
12. (Optional) Select the Use with subcompanies toggle to configure mapping to sub-companies.
13. (Optional) In the Company Mapping section, select a Mapping mode.
    • Select Domain identifier to assign users based on email domain.
    • Select Custom attribute to assign users based on a claim value sent by your identity provider.
14. If you selected Domain identifier as the mapping mode, for each mapping row, select the Company that to assign to users of the domain. If you added more than one domain identifier in the External IDP settings section, a mapping row per domain identifier is displayed.
15. (Optional) If you selected Custom attribute as the mapping mode:
    1. In Attribute name, enter the claim name your identity provider sends, for example, user.companyname.
    2. Select the Company that users should be assigned to.
    3. In Attribute value, enter the claim value that should map to that company.
    4. (Optional) To add more mapping rows, select Add mapping, then repeat steps 15b and 15c.
16. In the Permissions section, select the default permissions for new users who sign in via your IDP.
17. In the Sign-In Methods section, select whether to allow sign in with credentials. If enabled, when a user signs in for the first time using SAML, they can also continue to sign in using their regular credentials.
18. Select Save.

After you save the configuration, users can sign in using SAML in your test environment.

Enable single sign-on in production

When testing is successful, you can enable single sign-on in production:

1. Contact your ecosio Integration Engineer so they can enable SAML configuration in your production environment.
2. Repeat the set up steps in your production instance of the Monitor.