Skip to main content

How to Set Up SAML SSO for Your Organization

Updated this week

This guide outlines the steps to configure SAML-based Single Sign-On (SSO) for your account. Enabling SSO allows your team members to log in securely and conveniently using your company's existing identity provider (IdP), such as:

  • Microsoft Entra ID (Azure AD)

  • Google Workspace

  • Okta

  • Other SAML-based Identity Providers

Our SSO integration supports Just-in-Time (JIT) provisioning, which means user accounts are automatically created in our system the first time a new user signs in. This eliminates the need for manual invitations and streamlines your onboarding process. 🔐

Step 1: Initiate the Request

To begin, please contact your Reshape Biotech account representative or support team with the following information:

  1. Your Identity Provider Name (e.g., Okta, Azure AD, Google, etc.).

  2. The Email Domain(s) you wish to enable for SSO.

Once we receive this, we will provision the connection on our end and generate the following configuration values for you:

  • Entity ID (Audience URI)

  • ACS URL (Assertion Consumer Service / Single Sign-On URL)

Step 2: Configure Your Identity Provider

Once you receive the Entity ID and ACS URL from us, create a new SAML 2.0 application in your IdP.

CRITICAL: Attribute Mapping For the connection to work, your IdP must send specific user data to Reshape. If these are missing, users will encounter a saml_user_attribute_missing error.

Please ensure the following attributes are mapped:

Attribute Name

Data to Map (Description)

email

The user's email address [Required]

firstName

The user's first name

lastName

The user's last name

Step 3: Exchange Metadata

After configuring your IdP, we need to complete the handshake. Please provide us with one of the following:

  1. Metadata URL

  2. Metadata XML file

Once we receive your metadata, we will activate the connection and notify you.

Note: Please ensure you have assigned the relevant users or groups to the application in your IdP before testing the login.

Step 4: Final Test Login

Once we confirmed the connection is active, the last step is to do a final test login.

If you are a new customer you should already have some accounts to try the login with.

Otherwise, please inform us which accounts to invite to Discovery.

Attempt the final login and let us know of any issues you might have!

Important Notes

  • No SCIM support: Our authentication platform doesn’t support SCIM yet, but it is planned. This means accounts deleted/disabled in your IdP won’t be able to log in, but their existing sessions (if they are logged in) will be valid until they expire (currently max session is 30 days). If you need an account disabled immediately, a group admin can disable the user in the discovery settings page.

  • User access control: Be aware that you can control which users can access the Reshape Biotech Platform from the IdP side. Consider if its relevant to provide access to a subset of users.

  • Automatic User Provisioning: With JIT provisioning, a user's account will be created automatically upon their first successful SSO login. There is no need to invite users manually beforehand.

  • Permission Management: User roles and permissions are managed directly within our platform and do not sync from your IdP. An administrator will need to assign the appropriate permissions to new users after their first login.

If you're ready to get started or have any questions, please reach out to our support team.

Did this answer your question?