Generic SAML Setup

This guide covers configuring SSO with any SAML 2.0 compatible identity provider. Use this for ADFS, Okta, OneLogin, PingFederate, or any enterprise IdP supporting SAML.

Prerequisites

Before you begin, ensure you have:

• Admin access to your identity provider
• Organization owner or admin role in Securtea
• Your organization's email domain (e.g., yourcompany.com)

SAML Terminology

Step 1: Gather Securtea SAML Details

Before configuring your IdP, collect Securtea's SAML service provider details:

Service Provider Configuration

Replace {your-org-slug} with your Securtea organization's slug.

Example (if org slug is acme-corp):

• ACS URL: https://app.securtea.io/api/auth/sso/callback/saml-acme-corp
• Entity ID: https://app.securtea.io/saml/acme-corp

Step 2: Create Application in Your IdP

In your identity provider's admin console, create a new SAML application.

Common Settings

Attribute Statements

Configure your IdP to send these attributes in the SAML assertion:

Signature Settings

Step 3: Gather IdP Configuration

After creating the application, collect these values from your IdP:

Obtaining the Certificate

Your IdP provides a signing certificate in one of these formats:

• Base64-encoded (most common) - Copy the certificate string
• PEM file - Download and extract the base64 content
• Metadata XML - Extract from the <X509Certificate> element

The certificate should look like:

MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNVBAoM
...

Step 4: Configure SSO in Securtea

Navigate to SSO Settings

1. Sign in to your Securtea dashboard
2. Go to Settings > Organization > SSO Authentication
3. Select the SAML tab

Enter Configuration

Complete the form with the values from Step 3:

Email Domain

Enter your organization's email domain (e.g., yourcompany.com).

IdP Entity ID

Enter your identity provider's entity ID (issuer).

Examples:

• Okta: http://www.okta.com/{app-id}
• ADFS: http://adfs.yourcompany.com/adfs/services/trust

IdP SSO URL

Enter the identity provider's SAML 2.0 endpoint URL.

This is where Securtea redirects users for authentication.

IdP Certificate

Paste the X.509 certificate (base64-encoded content only, no markers).

Save Configuration

Click Configure SAML to save your settings.

Step 5: Test the Connection

After saving:

1. Locate the Test Connection section
2. Click Test
3. A new window opens to test authentication
4. Sign in with your IdP credentials
5. Review the results

If successful, you'll see user information returned by your IdP.

Provider-Specific Notes

Okta

Application Type: Select "SAML 2.0" when creating the integration.

Attribute Statements: Configure in the application's "SAML Settings" section.

Entity ID: Found in "View SAML Setup Instructions" → "Identity Provider Issuer"

ADFS (Active Directory Federation Services)

Relying Party Trust: Create a new relying party trust for Securtea.

Claims Rules: Configure claim rules to pass email as Name ID.

Certificate: Export the token-signing certificate from ADFS Management.

OneLogin

SAML Test Connector: Use the advanced SAML connector.

Parameters: Add email as a custom parameter mapped to Email.

Certificate: Download from the SSO tab of your application.

PingFederate / PingOne

Connection Type: SP-initiated SSO.

Protocol: SAML 2.0.

Attribute Contract: Include email address attribute.

Attribute Mapping

Required Attributes

At minimum, your IdP must send the user's email address. This can be:

• The SAML NameID (recommended)
• An attribute named email
• An attribute with a different name (configure mapping in IdP)

Name ID Formats

Securtea accepts these NameID formats:

We recommend emailAddress format for simplicity.

User Experience

SP-Initiated Flow

1. User visits Securtea and enters their email
2. Securtea detects SSO domain and generates SAML request
3. User is redirected to your IdP
4. User authenticates with corporate credentials
5. IdP generates SAML response and redirects to Securtea ACS
6. Securtea validates the assertion and signs in the user

IdP-Initiated Flow

Troubleshooting

"Invalid Signature" Error

Cause: Certificate mismatch or signature verification failed.

Fix:

1. Re-download the certificate from your IdP
2. Ensure you're using the signing certificate (not encryption)
3. Verify the certificate hasn't expired
4. Remove any header/footer markers

"Invalid Audience" Error

Cause: Entity ID mismatch between IdP and Securtea.

Fix:

1. Verify the Entity ID in your IdP matches Securtea exactly
2. Check for trailing slashes or URL encoding differences
3. Entity ID is case-sensitive

"Invalid Destination" Error

Cause: ACS URL mismatch.

Fix:

1. Verify the ACS URL in your IdP configuration
2. Include the full URL with protocol (https)
3. Ensure org slug is correct

"Missing Attribute" Error

Cause: Required attributes not included in assertion.

Fix:

1. Configure attribute statements in your IdP
2. Ensure email attribute is mapped correctly
3. Test the SAML response to verify attributes are present

Time-Related Errors

Cause: Clock skew between systems.

Fix:

1. Ensure your IdP server time is synchronized (NTP)
2. Securtea allows a 5-minute clock skew tolerance
3. Check for timezone issues in SAML timestamps

User Not Found / Created

Cause: Email extraction failed or domain mismatch.

Fix:

1. Verify email is sent in the SAML assertion
2. Check that the email domain matches your SSO configuration
3. Review attribute mapping in your IdP

Debugging SAML

View SAML Response

Most browsers have extensions to decode SAML traffic:

• SAML-tracer (Firefox/Chrome) - View SAML requests and responses
• SAML DevTools (Chrome) - Inspect SAML assertions

Check Assertion Contents

Verify your SAML assertion includes:

<saml:Assertion>
  <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
      user@yourcompany.com
    </saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="email">
      <saml:AttributeValue>user@yourcompany.com</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
</saml:Assertion>

Removing SAML Configuration

To remove SSO and revert to standard authentication:

1. Go to Settings > Organization > SSO Authentication
2. Click Remove Configuration
3. Confirm the removal

What's Next?

• Test your SSO configuration
• Invite team members
• Run your first assessment