SSO AuthenticationSAML 2.0
OneLogin
Configure OneLogin as a SAML 2.0 identity provider for Safeguard.
OneLogin
Example values
The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.
In OneLogin — the SAML app / SP details (you enter these at the IdP):
| Field | Example value |
|---|---|
| ACS URL (ACS (Consumer) URL) | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde/broker/onelogin/endpoint |
| SP Entity ID / Audience | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde |
| Name ID format | EmailAddress |
email attribute | the signed-in user's email (mapped from the Email field) |
In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):
| Field | Example value |
|---|---|
| Alias | onelogin |
| Display Name | Sign in with OneLogin |
| SSO Service URL | https://<subdomain>.onelogin.com/trust/saml2/http-post/sso/<id> |
| Entity ID | https://app.onelogin.com/saml/metadata/<id> |
| X.509 Certificate | the PEM block below |
-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE------ In OneLogin, go to Applications → Add App, search for "SAML Custom Connector," and add it.
- Under Configuration, set:
- ACS (Consumer) URL: the ACS URL Safeguard shows after Save
- Audience: the SP Entity ID Safeguard shows after Save
- Under Parameters, add a custom parameter named
emailmapped to the Email field — separate from the NameID policy OneLogin applies by default. - Under SSO, copy the SAML 2.0 Endpoint (HTTP), Issuer URL, and the X.509 Certificate.
- In Safeguard, click Add Provider → SAML 2.0 → OneLogin, and enter those three values.
- In OneLogin, assign users under the app's Users tab.
- Click Test in Safeguard to confirm.
Common errors: an "Invalid Login" error at OneLogin usually means the Audience field doesn't match what Safeguard expects, or the app isn't assigned to the signed-in user under Users.