Skip to content

Commit c7b3685

Browse files
inviscidinviscid
committed
adding other saml setup pages
1 parent be2925f commit c7b3685

4 files changed

Lines changed: 493 additions & 0 deletions

File tree

‎content/en/docs/Access_Management/advanced/auth0-saml-setup.md‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
title: Setting Up Auth0 SAML for Single Sign-On
3+
slug: auth0-saml-setup
4+
description: Configure Auth0 as a SAML identity provider for PlaidCloud Single Sign-On
5+
date: 2024-01-01T00:00:00
6+
tags:
7+
- plaidcloud
8+
- sso
9+
- saml
10+
- auth0
11+
categories:
12+
- PlaidCloud
13+
- Access Management
14+
---
15+
16+
PlaidCloud supports Single Sign-On (SSO) via SAML 2.0. This guide walks through configuring Auth0 as a SAML identity provider so your organization's users can authenticate through Auth0 when accessing PlaidCloud.
17+
18+
{{< note >}}
19+
The PlaidCloud-side configuration is handled by the PlaidCloud team. Your responsibility is to set up the SAML application in Auth0 and provide PlaidCloud with your **Identity Provider Metadata URL**. PlaidCloud support will complete the remaining configuration.
20+
{{< /note >}}
21+
22+
## Prerequisites
23+
24+
- An Auth0 tenant
25+
- An Auth0 account with the **Administrator** role
26+
- Contact with PlaidCloud support to coordinate the setup and exchange configuration values
27+
28+
## Overview
29+
30+
The setup process involves two parties exchanging SAML metadata:
31+
32+
1. **You configure** an application in Auth0 with the SAML2 Web App addon enabled and provide PlaidCloud with your Identity Provider Metadata URL.
33+
2. **PlaidCloud provides** you with the Service Provider (SP) Entity ID and ACS URL (Assertion Consumer Service URL) needed to complete your Auth0 application configuration.
34+
35+
Coordinate with PlaidCloud support to obtain the SP values before completing Step 3 below.
36+
37+
## Step 1: Create an Application
38+
39+
1. Sign in to the [Auth0 Dashboard](https://manage.auth0.com).
40+
2. In the left sidebar, navigate to **Applications** > **Applications**.
41+
3. Click **Create Application**.
42+
4. Enter a name for the application (e.g., `PlaidCloud SSO`).
43+
5. Select **Regular Web Applications** as the application type.
44+
6. Click **Create**.
45+
46+
## Step 2: Enable the SAML2 Web App Addon
47+
48+
1. On the application detail page, select the **Addons** tab.
49+
2. Click the **SAML2 Web App** addon to enable it.
50+
3. The addon settings panel will open. Leave it open — you will configure it in the next step.
51+
52+
## Step 3: Configure SAML Settings
53+
54+
{{< note >}}
55+
You will need the **SP Entity ID** and **ACS URL** from PlaidCloud before completing this step. Contact PlaidCloud support to obtain these values.
56+
{{< /note >}}
57+
58+
In the **SAML2 Web App** addon settings panel:
59+
60+
1. In the **Application Callback URL** field, enter the ACS URL provided by PlaidCloud.
61+
2. In the **Settings** JSON editor, set the `audience` field to the SP Entity ID provided by PlaidCloud:
62+
63+
```json
64+
{
65+
"audience": "your-sp-entity-id-from-plaidcloud",
66+
"mappings": {
67+
"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
68+
"given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
69+
"family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
70+
},
71+
"nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
72+
"nameIdentifierProbes": [
73+
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
74+
]
75+
}
76+
```
77+
78+
3. Click **Enable** (or **Save**) to apply the settings.
79+
80+
## Step 4: Retrieve and Send the Identity Provider Metadata URL
81+
82+
Once the addon is enabled, locate the metadata URL and send it to PlaidCloud so the integration can be completed.
83+
84+
1. In the **SAML2 Web App** addon settings panel, select the **Usage** tab.
85+
2. Copy the **Identity Provider Metadata** URL (formatted as `https://{your-auth0-domain}/samlp/metadata/{client-id}`).
86+
87+
**Send this Metadata URL to PlaidCloud support.** This is the Entity Descriptor URL that PlaidCloud needs to configure the trust relationship on the identity provider side. Once PlaidCloud receives this URL, the team will complete the Keycloak configuration and notify you when SSO is ready to test.
88+
89+
## Step 5: Configure Attribute Mappings for Groups (Optional)
90+
91+
If your PlaidCloud configuration uses group-based security role assignments, you can pass group membership through the SAML assertion using Auth0 rules or actions.
92+
93+
### Using Auth0 Actions
94+
95+
1. In the left sidebar, navigate to **Actions** > **Library**.
96+
2. Click **Build Custom** and create a new action for the **Login / Post Login** trigger.
97+
3. Add logic to append group information to the SAML assertion. For example, if groups are stored as user metadata:
98+
99+
```javascript
100+
exports.onExecutePostLogin = async (event, api) => {
101+
const groups = event.user.app_metadata?.groups || [];
102+
api.samlResponse.setAttribute("groups", groups);
103+
};
104+
```
105+
106+
4. Deploy the action and add it to the **Login** flow.
107+
108+
{{< note >}}
109+
Discuss with PlaidCloud support which group attribute name and format are expected so that group-based security role assignments work correctly in PlaidCloud.
110+
{{< /note >}}
111+
112+
## Step 6: Control User Access
113+
114+
Auth0 controls which users can authenticate based on the connections and rules attached to the application.
115+
116+
1. On the application detail page, select the **Connections** tab.
117+
2. Enable the appropriate connections (e.g., your organization's database connection, Active Directory, or social connections) for this application.
118+
3. Disable any connections that should not have access to PlaidCloud.
119+
120+
To restrict access to specific users within a connection, use Auth0 Actions or Rules to allow or deny authentication based on user attributes or group membership.
121+
122+
## Testing the Integration
123+
124+
After PlaidCloud confirms the configuration is complete:
125+
126+
1. Navigate to your organization's PlaidCloud Workspace (e.g., `https://my-workspace.plaid.cloud`).
127+
2. You will be redirected to the Auth0 sign-in page (or your configured connection's login).
128+
3. Sign in with your Auth0 credentials.
129+
4. Upon successful authentication, you will be redirected back to PlaidCloud.
130+
131+
If you encounter errors, verify that:
132+
- The Application Callback URL and audience match exactly what PlaidCloud provided
133+
- The SAML2 Web App addon is enabled on the application
134+
- The `nameIdentifierFormat` is set to the email address format
135+
- The Metadata URL you sent to PlaidCloud is accessible
136+
- The user's connection is enabled on the application

‎content/en/docs/Access_Management/advanced/aws-saml-setup.md‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
title: Setting Up AWS IAM Identity Center SAML for Single Sign-On
3+
slug: aws-saml-setup
4+
description: Configure AWS IAM Identity Center as a SAML identity provider for PlaidCloud Single Sign-On
5+
date: 2024-01-01T00:00:00
6+
tags:
7+
- plaidcloud
8+
- sso
9+
- saml
10+
- aws
11+
- iam
12+
categories:
13+
- PlaidCloud
14+
- Access Management
15+
---
16+
17+
PlaidCloud supports Single Sign-On (SSO) via SAML 2.0. This guide walks through configuring AWS IAM Identity Center (formerly AWS SSO) as a SAML identity provider so your organization's users can authenticate through AWS when accessing PlaidCloud.
18+
19+
{{< note >}}
20+
The PlaidCloud-side configuration is handled by the PlaidCloud team. Your responsibility is to set up the custom SAML application in IAM Identity Center and provide PlaidCloud with your **IAM Identity Center SAML Metadata URL**. PlaidCloud support will complete the remaining configuration.
21+
{{< /note >}}
22+
23+
## Prerequisites
24+
25+
- An AWS account with **IAM Identity Center** enabled
26+
- An IAM user or role with the **AWSSSOMasterAccountAdministrator** managed policy or equivalent permissions
27+
- IAM Identity Center must be configured with an identity source (the built-in directory, Active Directory, or an external IdP)
28+
- Contact with PlaidCloud support to coordinate the setup and exchange configuration values
29+
30+
## Overview
31+
32+
The setup process involves two parties exchanging SAML metadata:
33+
34+
1. **You configure** a custom SAML application in IAM Identity Center and provide PlaidCloud with your SAML Metadata URL.
35+
2. **PlaidCloud provides** you with the Service Provider (SP) Entity ID and ACS URL (Assertion Consumer Service URL) needed to complete your application configuration.
36+
37+
Coordinate with PlaidCloud support to obtain the SP values before completing Step 3 below.
38+
39+
## Step 1: Create a Custom SAML Application
40+
41+
1. Sign in to the [AWS Management Console](https://console.aws.amazon.com) and navigate to **IAM Identity Center**.
42+
2. In the left sidebar, select **Applications**.
43+
3. Click **Add application**.
44+
4. Select **I have an application I want to set up** and choose **Custom SAML 2.0 application**.
45+
5. Click **Next**.
46+
6. Enter a **Display name** for the application (e.g., `PlaidCloud SSO`) and optionally a description.
47+
48+
## Step 2: Retrieve the IAM Identity Center SAML Metadata URL
49+
50+
Before configuring the service provider details, locate your IAM Identity Center metadata URL to send to PlaidCloud.
51+
52+
1. On the application configuration page, scroll to the **IAM Identity Center metadata** section.
53+
2. Copy the **IAM Identity Center SAML metadata URL** (formatted as `https://portal.sso.{region}.amazonaws.com/saml/metadata/{instanceId}`).
54+
55+
**Send this Metadata URL to PlaidCloud support.** This is the Entity Descriptor URL that PlaidCloud needs to configure the trust relationship on the identity provider side. Once PlaidCloud receives this URL, the team will complete the Keycloak configuration and notify you when SSO is ready to test.
56+
57+
## Step 3: Configure Service Provider Details
58+
59+
{{< note >}}
60+
You will need the **SP Entity ID** and **ACS URL** from PlaidCloud before completing this step. Contact PlaidCloud support to obtain these values.
61+
{{< /note >}}
62+
63+
1. Scroll to the **Application properties** section.
64+
2. In the **Application ACS URL** field, enter the ACS URL provided by PlaidCloud.
65+
3. In the **Application SAML audience** field, enter the SP Entity ID provided by PlaidCloud.
66+
4. Click **Submit**.
67+
68+
## Step 4: Configure Attribute Mappings
69+
70+
IAM Identity Center passes user attributes to PlaidCloud in the SAML assertion. Configure attribute mappings so PlaidCloud receives the necessary user details.
71+
72+
1. On the application detail page, select the **Attribute mappings** tab.
73+
2. Click **Add new attribute mapping** and add the following:
74+
75+
| User attribute in the application | Maps to this string value or user attribute in IAM Identity Center | Format |
76+
|---|---|---|
77+
| `Subject` | `${user:email}` | emailAddress |
78+
| `email` | `${user:email}` | unspecified |
79+
| `firstName` | `${user:givenName}` | unspecified |
80+
| `lastName` | `${user:familyName}` | unspecified |
81+
82+
3. Click **Save changes**.
83+
84+
### Group Membership (Optional)
85+
86+
IAM Identity Center does not natively pass group membership as a SAML attribute in the same way as other providers. If your PlaidCloud configuration requires group-based security role assignments, discuss the available options with PlaidCloud support. Common approaches include using the built-in directory with group assignments or syncing groups from an external identity source such as Active Directory.
87+
88+
{{< note >}}
89+
Discuss with PlaidCloud support how group membership should be conveyed so that group-based security role assignments work correctly in PlaidCloud.
90+
{{< /note >}}
91+
92+
## Step 5: Assign Users and Groups to the Application
93+
94+
Only users and groups assigned to the application will be able to authenticate through this SSO configuration.
95+
96+
1. On the application detail page, select the **Assign users and groups** tab.
97+
2. Click **Assign users and groups**.
98+
3. Search for and select the users or groups that should have SSO access to PlaidCloud.
99+
4. Click **Assign users**.
100+
101+
## Testing the Integration
102+
103+
After PlaidCloud confirms the configuration is complete:
104+
105+
1. Navigate to your organization's PlaidCloud Workspace (e.g., `https://my-workspace.plaid.cloud`).
106+
2. You will be redirected to the AWS IAM Identity Center sign-in page.
107+
3. Sign in with your AWS IAM Identity Center credentials.
108+
4. Upon successful authentication, you will be redirected back to PlaidCloud.
109+
110+
If you encounter errors, verify that:
111+
- The ACS URL and SP Entity ID match exactly what PlaidCloud provided
112+
- The user attempting to log in is assigned to the application in IAM Identity Center
113+
- The Subject attribute is mapped to `${user:email}` with the **emailAddress** format
114+
- The Metadata URL you sent to PlaidCloud is accessible from PlaidCloud's servers

‎content/en/docs/Access_Management/advanced/google-saml-setup.md‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
---
2+
title: Setting Up Google Workspace SAML for Single Sign-On
3+
slug: google-saml-setup
4+
description: Configure Google Workspace as a SAML identity provider for PlaidCloud Single Sign-On
5+
date: 2024-01-01T00:00:00
6+
tags:
7+
- plaidcloud
8+
- sso
9+
- saml
10+
- google
11+
- workspace
12+
categories:
13+
- PlaidCloud
14+
- Access Management
15+
---
16+
17+
PlaidCloud supports Single Sign-On (SSO) via SAML 2.0. This guide walks through configuring Google Workspace as a SAML identity provider so your organization's users can authenticate through Google when accessing PlaidCloud.
18+
19+
{{< note >}}
20+
The PlaidCloud-side configuration is handled by the PlaidCloud team. Your responsibility is to set up the custom SAML app in Google Workspace and provide PlaidCloud with your **IdP Metadata URL**. PlaidCloud support will complete the remaining configuration.
21+
{{< /note >}}
22+
23+
## Prerequisites
24+
25+
- A Google Workspace account (Business Starter or higher)
26+
- A Google Workspace account with the **Super Admin** role
27+
- Contact with PlaidCloud support to coordinate the setup and exchange configuration values
28+
29+
## Overview
30+
31+
The setup process involves two parties exchanging SAML metadata:
32+
33+
1. **You configure** a custom SAML app in Google Workspace and provide PlaidCloud with your IdP Metadata URL.
34+
2. **PlaidCloud provides** you with the Service Provider (SP) Entity ID and ACS URL (Assertion Consumer Service URL) needed to complete your Google Workspace configuration.
35+
36+
Coordinate with PlaidCloud support to obtain the SP values before completing Step 3 below.
37+
38+
## Step 1: Create a Custom SAML App
39+
40+
1. Sign in to the [Google Admin console](https://admin.google.com) as a Super Admin.
41+
2. Navigate to **Apps** > **Web and mobile apps**.
42+
3. Click **Add app** > **Add custom SAML app**.
43+
4. Enter a name for the app (e.g., `PlaidCloud SSO`) and optionally add a description and icon.
44+
5. Click **Continue**.
45+
46+
## Step 2: Retrieve the IdP Metadata URL
47+
48+
On the **Google Identity Provider details** screen, Google displays the identity provider information needed by PlaidCloud.
49+
50+
1. Copy the **SSO URL**, **Entity ID**, and download the **Certificate** — or
51+
2. Click **Copy** next to the **IDP metadata** URL (formatted as `https://accounts.google.com/o/saml2/idp?idpid=XXXXXXXXX`).
52+
53+
**Send this IdP Metadata URL to PlaidCloud support.** This is the Entity Descriptor URL that PlaidCloud needs to configure the trust relationship on the identity provider side. Once PlaidCloud receives this URL, the team will complete the Keycloak configuration and notify you when SSO is ready to test.
54+
55+
3. Click **Continue** to proceed to the Service Provider configuration.
56+
57+
## Step 3: Configure Service Provider Details
58+
59+
{{< note >}}
60+
You will need the **SP Entity ID** and **ACS URL** from PlaidCloud before completing this step. Contact PlaidCloud support to obtain these values.
61+
{{< /note >}}
62+
63+
1. In the **ACS URL** field, enter the ACS URL provided by PlaidCloud.
64+
2. In the **Entity ID** field, enter the SP Entity ID provided by PlaidCloud.
65+
3. Leave **Start URL** blank unless PlaidCloud support instructs otherwise.
66+
4. Set **Name ID format** to **EMAIL**.
67+
5. Set **Name ID** to **Basic Information > Primary email**.
68+
6. Click **Continue**.
69+
70+
## Step 4: Configure Attribute Mapping
71+
72+
Google Workspace passes user attributes to PlaidCloud in the SAML assertion. At minimum, map the user's email address. If your PlaidCloud configuration uses group-based security role assignments, also map group membership.
73+
74+
### Basic Attribute Mapping
75+
76+
Add the following attribute mappings on the **Attribute mapping** screen:
77+
78+
| Google Directory attribute | App attribute |
79+
|---|---|
80+
| Primary email | `email` |
81+
| First name | `firstName` |
82+
| Last name | `lastName` |
83+
84+
Click **Add mapping** to add each row.
85+
86+
### Group Membership (Optional)
87+
88+
If you want PlaidCloud to automatically assign users to security groups based on their Google group membership:
89+
90+
1. Click **Add mapping**.
91+
2. Under **Google Directory attributes**, select **Group membership** and choose the relevant Google Groups.
92+
3. Set the **App attribute** name to `groups` (confirm the expected name with PlaidCloud support).
93+
94+
{{< note >}}
95+
Discuss with PlaidCloud support which group attribute name and format is expected so that group-based security role assignments work correctly in PlaidCloud.
96+
{{< /note >}}
97+
98+
Click **Finish**.
99+
100+
## Step 5: Enable the App for Users
101+
102+
By default, a new SAML app is disabled for all users. Enable it for the appropriate organizational units or groups.
103+
104+
1. On the app detail page, click **User access**.
105+
2. Select the organizational unit or groups that should have SSO access to PlaidCloud.
106+
3. Set the service status to **ON**.
107+
4. Click **Save**.
108+
109+
## Testing the Integration
110+
111+
After PlaidCloud confirms the configuration is complete:
112+
113+
1. Navigate to your organization's PlaidCloud Workspace (e.g., `https://my-workspace.plaid.cloud`).
114+
2. You will be redirected to the Google sign-in page.
115+
3. Sign in with your Google Workspace credentials.
116+
4. Upon successful authentication, you will be redirected back to PlaidCloud.
117+
118+
If you encounter errors, verify that:
119+
- The SP Entity ID and ACS URL match exactly what PlaidCloud provided
120+
- The user attempting to log in belongs to an organizational unit or group with the app enabled
121+
- The Name ID format is set to **EMAIL** and mapped to **Primary email**
122+
- The IdP Metadata URL you sent to PlaidCloud is accessible

0 commit comments

Comments
 (0)