Configure SAML Single Sign-On

Have these permissions:

sso.saml.settings.edit

sso.saml.settings.read

The full metadata files in .xml format from your Identity Provider (IdP). If you use the same IdP for your Test and Production tenants, only 1 metadata file is required. See Collect VNDLY Metadata Files.

Determine whether users will initiate single sign-on (SSO) from VNDLY (service provider) or from the IdP.

Metadata files are usually in a .xml file format and are not a certificate. VNDLY uses the metadata files to finish the SSO setup.

From the header, select

Company Settings

From the

Security

section, click

SAML Single Sign On

Click

Default

As you complete the

Details

tab, consider:

Option	Description
Label	Enter a name for the server.
Service provider entity ID override	Enter a different entity ID if you want to override the default service provider entity ID and change how VNDLY identifies itself as the SAML service provider.
Allow unsolicited	Select the check box if your tenant is set up to use IdP-initiated login to allow users to initiate a login from the IdP.
Require Signed Response	Select the option whether the IdP requires a signed response and/or a signed assertion. The recommended option is Require signed response .
Allowed clock skew	Enter the number of seconds that VNDLY allows for assertion timestamps to skew past their cutoff. Clocks between remote systems can often differ by significant amounts of time and clock skews can help to account for the varied time differences. Example: Server clocks are often not in sync with each other. If an authorization message arrives after its valid date/time, then VNDLY rejects it. Adding time with the clock skew field allows for additional time to account for the slight differences in the server clocks and VNDLY will accept messages that arrive within the allowed clock skew range.
Metadata valid duration	Enter the number of hours to mark the VNDLY metadata as valid. When the VNDLY metadata expires, your IdP can automatically obtain an updated VNDLY metadata file.
Allowed name ID formats	Indicates the name ID formats that are allowed from a dropdown menu. Ensure all values are selected.
PREFERRED SINGLE-SIGN-ON BINDING ORDER	Defines the order VNDLY searches IdP metadata files when looking for SSO bindings.
PREFERRED SINGLE-SIGN-OUT BINDING ORDER	Defines the order VNDLY searches IdP metadata when looking for single logout bindings.

Click

Save

On the

Identity Providers

tab, click

Single Sign On - SAML

As you configure the

Identity Provider

settings, consider:

Option	Description
Label	Label for the identity provider. The label appears as a dropdown option when updating a user’s authentication method.
External Identifier	Value used when referring to the IdP in external integrations. It indicates which IdP should be used when performing account bulk uploads in VNDLY.
IdP metadata	Copy and paste the SAML metadata from the metadata file provided by your IdP for this tenant.
Bypass metadata validation	Select the check box to enable VNDLY to bypass the metadata validation. Some metadata files may contain SAML extensions that cause validation errors even when valid.
Name ID policy format	Select the name identifier to use for users. You can obtain the policy format from the IdP metadata file. If the name ID policy format is missing within the metadata, select unspecified .
Signing algorithm	Select the signing algorithm indicated in the IdP metadata file. You can search for keyword signing in the IdP metadata file.
Digest algorithm	Select the digest algorithm indicated in the IdP metadata file. You can search for keyword digest in the IdP metadata file.
Chained logout URL	Enter a custom URL if you wish to skip the SAML logout process and redirect the user to the specified URL when the user logs out of VNDLY. The user is also logged out of all other applications from the user’s IdP. If the chained logout URL is blank, a user may still be logged out of all applications if single logout (SLO) is set up within your IdP.
Use subject as username	Select the check box to use the subject value as the highest priority username option. SAML assertions contain a subject field and additional attributes. Typically, the username comes from the attributes. In some cases, the IdP expects to use the subject field as the username instead.
USERNAME ATTRIBUTES	Add SAML attributes for VNDLY to search and use as the username during authentication. Attributes may be customized as needed to align with your IdP configuration. It’s recommended to use the username attribute to identify the user, as the username attribute in VNDLY is unique. This means the same username cannot be used twice when creating a user. Example of Username Attribute: test.user Recommended attributes: NameID http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn nickname principalname urn:mace:dir:attribute-def:eduPersonPrincipalName urn:oid:1.3.6.1.4.1.5923.1.1.1.6 Username A sample of user attributes exposed by the IdP may assist with mapping user attributes in VNDLY.
EMAIL ATTRIBUTES	Add SAML attributes for VNDLY to search and use as the e-mail during authentication. Attributes may be customized as needed. It’s not recommended to use an email field to identify the user as multiple user accounts in VNDLY can have the same email address. Example of Email Attribute: test@email.com Recommended attributes: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress urn:mace:dir:attribute-def:mail urn:oid:0.9.2342.19200300.100.1.3

Take note of the value you entered in the

External Identifier

field. You'll need it when setting the authentication method for users.

Click

Save

(Optional) To configure an additional IdP:

Navigate to the

Identity Providers

tab.

Click

Create

Complete Steps 7 and 8 for the additional IdP.

Repeat the above steps for your other VNDLY tenants.

We recommend that you save the original metadata file from your IdP in case you need to make updates or revert to a previous version.