Admin SSO

Overview

You can use your preferred Identity Provider (IdP) to access Material's Admin console. This guide provides the steps necessary to set up SAML and use your identity provider to login.

Configure

Prerequisites

• Required Roles: Material Super Admin or Tenant Admin
• Admin access to your preferred authentication provider

Enable

1. Navigate to Admin Console within Settings.

Now follow the IdP specific instructions below to configure Admin SSO with your identity provider.

Google Workspace SAML

• In a new tab, navigate to the Web and mobile apps page in the Google Admin Console.
• Click Add App, then Add custom SAML app.
• Name the application "Material Admin SSO".
• Click Continue.
• On the Google Identity Provider details page, use Option 1: Download Metadata.
• In Material's Admin Console enter the downloaded XML in the configuration dialog. Click Save.
• On the Google Identity Provider details page, Click Continue.
• Enter the following Service Provider Details

  • ACS URL: Use the value provided in Material (SSO Url)
  • Entity ID: Use the value provided in Material (Entity ID)
  • Name ID format: EMAIL
• Click Continue.
• Don’t add any Attribute Mappings and click Finish.
• You will be redirected to the page for the SAML App you just created.
• Click User access.
• In the left column, select "All users in this account".
• Confirm the Service Status is set to "OFF for everyone".
• Click Save.
• In the left column, use either Groups or Organization Units to find and designate a user population should be able to sign in to Material's Admin console.
• Select the Group or OU.
• Set the Service Status to ON.
• Click Save.

Microsoft 365 SAML

• In a new tab, navigate to the Azure Active Directory page in the Microsoft 365 Admin console (In the Microsoft 365 Admin console, go to Home > Show All > Azure Active Directory).
• Under Manage > Enterprise applications, click + New Application.
• Click + Create your own application.

  • Name the application "Material Admin SSO"
  • Select Integrate any other application you don’t find in the gallery (Non-gallery)
  • Click Create
• You will be redirected to the page for the app you just created.
• Under Manage > Properties, confirm Visible to users? is set to Yes.
• Click Save.
• Under Manage > Single sign-on, click SAML
• Edit the Basic SAML Configuration as follows

  • Identifier (Entity ID): Add the value provided in Material (Entity ID).
  • Reply URL (Assertion Consumer Service URL): Use the value provided in Material (SSO Url).
• Click Save.
• Edit the Attributes & Claims as follows:

  • Unique User Identifier (Name ID): Change the value of the Source attribute from user.userprincipalname to user.mail
• Click Save.
• Navigate back to SAML-based Sign-on. Alternately click Enterprise applications > All applications > "Material Admin SSO" > under Manage > Single sign-on.
• Under SAML Signing Certificate, download the Federation Metadata XML and enter the downloaded XML in the configuration dialog in Material. Click Save.
• Back in Azure, on the left column click Manage > Users and groups, find and designate a user population should be able to sign in to Material's Admin console.

Okta SAML

• In a new tab, sign in to the Okta Admin Console, navigate to Applications > Applications.
• Click Create App Integration.
• In the Create a new app integration dialog, choose SAML 2.0 and click Next.
• Name the application "Material Admin SSO" and click Next.
• In Configure SAML step, in the SAML Settings section, enter values for:

  • Single sign on URL: Use the SSO Url value provided back in Material.
  • Audience URI: Use the Entity ID value provided back in Material.
• Click Next
• On the last page, select "I'm an Okta customer adding an internal app", and click Finish.
• Under the Sign On tab:

  • To the right of the SAML Signing Certificates section, click the View SAML setup instructions button.
  • Copy the IdP metadata from the bottom of the screen.
  • Paste the displayed metadata in the Identity Provider (IdP) XML Metadata dialog in Material.
  • Click Save in Material.
• In Okta, navigate to the application and select the Assignments tab:

  • Assign the "Material Admin SSO" application to the relevant user population that should be able to sign in to Material's Admin console.