Configure single sign-on using another IdP

This feature is only available on our Enterprise plan. Contact sales for more information.

Before you begin, make sure you have an Admin account (Viewer or Contributor) with Abstract.

Step 1: Configure SAML 2.0 for Abstract

Abstract supports SAML 2.0 protocol. If your IdP uses the SAML 2.0 protocol, you may be able to configure SSO in Abstract.

You may need to add the following information to your IdP:

Resource

Value

Abstract’s EntityId

https://auth.goabstract.com

Abstract’s Assertion Consumer Service (ACS) URL

https://auth.goabstract.com/saml/response

Audience Restriction

https://auth.goabstract.com

About SAML responses:

  • We currently only support HTTP:POST binding.
  • We are expecting an “email” Assertion Attribute, as shown below.

<saml2:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">

    <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">email@example.org</saml2:AttributeValue>

</saml2:Attribute>

Step 2: Set up SAML single sign-on in Abstract

  1. Open the Abstract app (desktop or web).
  2. In the left side pane, click on the organization name.
  3. From the dropdown, select Organization Settings.
  4. Select the Permissions tab.
  5. In the Configure SSO section, enter your Metadata URL and Entity ID.
  6. Enter any manual exceptions you might have. Emails listed in the manual exceptions section bypass SSO and can log in with email and password.
  7. Click Test with my Account. If the test fails, contact our support team to manually enable SSO.
  8. Toggle Activate SSO on. 
  9. Click Save Changes.

Related