SAML SSO setup
This page is a general reference for IT teams setting up SAML SSO with Artifactive. Your Artifactive dashboard shows the setup values for your tenant, and we can help if your team wants an assisted setup.
Provider-specific setup guides
- Google Workspace SAML SSO setup
- Microsoft Entra ID SAML SSO setup
- Okta SAML SSO setup
- Custom SAML SSO setup
How setup works
- Artifactive provides service-provider values in the dashboard.
- Your IdP admin creates a SAML application.
- Your IdP admin enters the Artifactive ACS URL and Entity ID.
- Your IdP admin assigns the users, groups, or organizational units that should have access.
- Artifactive records the identity-provider metadata.
- An Owner runs Test SSO in Artifactive before enabling SSO-only access.
Values from Artifactive
| Value | How it is used |
|---|---|
| ACS URL / Reply URL / Single sign-on URL | Paste this into your IdP as the destination for SAML responses. |
| Entity ID / Audience URI / Identifier | Paste this into your IdP as the service provider identifier or audience. |
| Name ID format | Use email address if your IdP asks. |
| Start URL / RelayState | Leave blank unless Artifactive provides one. |
Values from your identity provider
- Metadata URL or metadata XML, preferred.
- IdP Entity ID / Issuer.
- SSO URL.
- x.509 signing certificate.
- Assigned users, groups, or organizational units.
Provider notes
- Okta: create a SAML 2.0 app integration; use ACS URL for Single sign-on URL and Entity ID for Audience URI; assign users or groups.
- Microsoft Entra ID: create a non-gallery enterprise app; configure SAML; use Identifier and Reply URL; assign users or groups.
- Google Workspace: create a custom SAML app; use ACS URL and Entity ID; set Name ID to primary email; turn app access on for users or organizational units.
- Other SAML 2.0 IdPs: use the same ACS URL, Entity ID, and metadata exchange.
Testing before enforcement
- Run Test SSO from Artifactive.
- Test with an assigned user on an approved company email domain.
- Do not switch to SSO-only until the test passes.
- For team SSO-only, confirm Owner access and recovery before enforcing it.
Common setup issues
- User is not assigned to the SAML app.
- ACS URL or Entity ID does not exactly match.
- NameID/email is missing or not the user's work email.
- Metadata or signing certificate changed after setup.
- Google app access is not turned on for the user or organizational unit.