IMPORTANT WARNING
Once SSO is enabled, it can NOT be reversed. Make sure you have thoroughly tested the configuration before activation. All existing user authentication will be replaced by SSO.
Prerequisites
Before you start, make sure you have the following access and systems:
- Administrator access to the IdPYou need administrator access to your organisation's Identity Provider
- Preppio Enterprise accountSSO is only available to Enterprise customers
- SAML 2.0 supportYour IdP must support the SAML 2.0 protocol
Supported Identity Providers
Preppio supports all SAML 2.0 compliant Identity Providers. Popular suppliers include:
Select and configure Identity Provider (IdP)
Set up your organization's Identity Provider for SAML 2.0 integration
- 1Log in to your Identity Provider (Azure AD, Okta, OneLogin, etc.)
- 2Create a new application for Preppio
- 3Select SAML 2.0 as the authentication protocol
- 4Configure the application with Preppio-specific settings
- 5Set the ACS URL to: https://app.preppio.com/auth/saml/callback
Gather the necessary information from the IdP
Get SAML configuration details from your Identity Provider
- 1SAML URL (SSO endpoint) - where SAML requests are sent
- 2SAML Issuer URL - unique identifier for your IdP
- 3X.509 Certificate - public certificate for signing SAML assertions
- 4Entity ID - unique identifier of the SAML entity
- 5Metadata URL (optional) - automatic configuration
Configure user attributes
Set up attribute mapping between IdP and Preppio
- 1Email - required attribute for user identification
- 2First Name - used for personalisation
- 3Last Name - used for personalisation
- 4Groups/Roles - for access control (optional)
- 5Verify that the attribute names match Preppio's expectations
Configure Preppio SSO settings
Enter IdP information in the Preppio dashboard
- 1Log in to the Preppio dashboard as an administrator
- 2Navigate to 'Settings' > 'Authentication' > 'Single Sign-On'
- 3Enter the SAML URL, Issuer URL and X.509 certificate
- 4Configure attribute mapping for user fields
- 5Save the configuration (NB: Cannot be reversed!)
Test the SSO integration
Verify that SSO is working correctly before full deployment
- 1Test login with a test user from your organisation
- 2Verify that user attributes are transferred correctly
- 3Check that access levels and roles work as expected
- 4Test logout and re-authentication
- 5Document any problems and adjust the configuration
Enable SSO for your organization
Roll out SSO to all users in the organization
- 1Inform users about the transition to SSO
- 2Enable SSO as the required authentication method
- 3Disable local user accounts (optional)
- 4Monitor login activity in the first few days
- 5Provide support for users experiencing problems
Security best practices
- Use strong X.509 certificates with minimum 2048-bit keys
- Enable SAML assertion encryption when possible
- Set short expiration times for SAML assertions (5-10 minutes)
- Implement group-based access control for better security
Troubleshooting
Users cannot log in with SSO
Verify the SAML URL, Issuer URL, and certificate configuration. Also check that user attributes are sent correctly.
Certificate error or signature error
Make sure the X.509 certificate is correctly formatted and not expired. Also check clock synchronization.
User information is missing or incorrect
Check attribute mapping between IdP and Preppio. Make sure that required fields such as email are sent.