Security

Setting Up Enterprise SAML SSO – Step-by-Step Guide

Detailed guide for setting up Enterprise SAML SSO with an existing Identity Provider (Okta, Azure AD, Google Workspace).

191 views0 found this helpful

Prerequisites

Before SAML SSO can be set up, the following conditions must be met:

  1. SSO Activation: Our team must activate Enterprise SSO for the organization. The request form can be used under Team Settings → Security.

  2. Identity Provider: Access to a SAML 2.0-compatible Identity Provider (e.g., Okta, Azure AD, Google Workspace, PingIdentity, OneLogin) is required.

  3. Organization Owner Role: Only organization owners can configure SAML SSO.

Step 1: Calentix Information for Your IdP

The exact URLs for the organization can be found in the security settings after activation or will be provided by our support team.

Step 2: Copy Metadata URL from the IdP

The Identity Provider provides a SAML Metadata URL. This URL contains all configuration data (certificates, endpoints, etc.) in an XML document.

Where to find the Metadata URL:

  • Okta: App Settings → Sign On → Identity Provider metadata (copy link)

  • Azure AD / Entra: Enterprise Applications → App name → Single sign-on → Federation Metadata URL

  • Google Workspace: Admin Console → Apps → Web and mobile apps → App name → Download metadata (as file, URL not available)

Step 3: Configure SAML in Calentix

  1. Navigate to Team Settings → Security.

  2. Scroll to the Enterprise SSO (SAML 2.0) section.

  3. Enter the Metadata URL of the Identity Provider.

  4. Enter the organization's email domain (e.g., mycompany.com).

  5. Click on Set up SSO.

Step 4: Confirmation Dialog

Before activation, a notice with important information will appear:

  • Billing: Employees who log in via SSO are automatically added as team members and billed.

  • Existing Accounts: Accounts previously registered via email/password or OAuth will not automatically link to the SSO account. These employees will receive a new account. We recommend removing existing accounts beforehand.

  • Login Restriction: Optionally, it can be set that only SSO is allowed as a login method (recommended).

Step 5: Testing

  1. Open the Calentix login page in an incognito window.

  2. Click on SAML/OIDC.

  3. Enter an email address with the configured domain.

  4. You will be redirected to the configured Identity Provider.

  5. After successful authentication, you will be logged into the Calentix dashboard.

Remove SSO Provider

If SAML SSO needs to be deactivated, navigate to Team Settings → Security and click on Remove SSO Provider. Please note: existing SSO users will no longer be able to log in and an alternative login method will be needed.

Common Issues

“No SSO provider configured for this domain”

Ensure that the entered email domain exactly matches the configured SSO domain.

“SAML assertion does not contain email address”

The Identity Provider must send the email address in the SAML assertion. It is necessary that the attribute mapping in the IdP is correct, so that email or mail is included as an attribute.

Employee has two accounts

SSO accounts are not automatically linked with existing email/password accounts. The old account of the employee must be removed from the team so that only the SSO account is active.

War dieser Artikel hilfreich?