--- title: SSO slug: altrata-web-resource-center/sso docTags: createdAt: 2025-04-11T19:16:47.132Z --- ## Overview By leveraging SAML, users can be easily authenticated to login to Altrata through your existing corporate SSO solution (the identity provider). Altrata supports the following: - SAML 2.0 - Service Provider (SP) Initiated authentication - Signed tokens using X509 certificates with 2048-bit keys - SHA-256 (minimum) as the signature/secure hash algorithm - Just in Time user provisioning for new user accounts :::hint{type="info"} The self-service password reset function will no longer work after SSO goes to production, as users will authenticate using their configured IdP. We recommend that you communicate the change to your users to help them understand the changes that happen after implementing a production SSO configuration to Altrata. ::: ## Customer Prerequisites 1. An Identity Provider (IdP), or Identity Access Management (IAM) solution (e.g. Azure AD, Microsoft AD FS, Entra ID) that supports: 1. SAML 2.0 2. Service Provider (SP) Initiated authentication 2. An SSO App configured by the customer on their Identity Provider, referencing the attributes below from Altrata: 1. **Identifier (URN)** (also referred to as **Entity ID**): `urn:amazon:cognito:sp:us-east-2_WxqRzRqrX` 2. **Assertion Customer URL:** `https://auth.altrata.com/saml2/idpresponse` 3. The configured SSO App would also have users, or internal security groups, assigned to it, and access to Altrata will be limited to those select users. 4. An exported metadata XML file, or metadata URL, from the configured SSO app which will be shared with the designated Altrata account manager or point of contact. The provided metadata will be used by Altrata to configure the trust between the SP and IdP. ## SAML Claim Configuration Altrata expects the following claims in the token returned from the IdP in the format noted. While not all claim types are required, the additional claims are useful to help Altrata better support users and troubleshoot any issues. :::hint{type="info"} All claim types below are case sensitive and must be sent using the format specified in the Claim Type. ::: | Claim Name | Data | Required | Description | Claim Type URI | | ---------------- | --------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | | **Name ID** | User Identifier | TRUE | Unique and immutable value that identifies the user. It usually contains the user’s email address, which is the recommended convent | [nameidentifer](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier) | | **emailaddress** | Email Address | TRUE | The user's email address | [emailaddress](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress) | | **givenname** | First Name | TRUE | The user's first name | [givenname](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname) | | **surname** | Last Name | TRUE | The user's surname | [surname](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname) | | **department** | Department | FALSE | Department data. Used for allocating product features. | | | **jobtitle** | Role | FALSE | Job title / Role data. Used for allocating product features. | [role](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role) | | **country** | Region | FALSE | Job title / Role data. Used for allocating product features and in some cases Region specific data. | [region](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/region) | ## Common Identity Provider Configurations ### Microsoft Entra The following guide can be used for setting up an SSO application in Microsoft Entra. :::hint{type="info"} The process of configuring an application to use Microsoft Entra ID for SAML-based SSO varies depending on the application. For any of the enterprise applications in the gallery, use the **configuration guide** link to find information about the steps needed to configure the application. ::: 1. Sign in to the Microsoft Entra admin center using an account with at least a Cloud Application Administrator role. 2. Browse to** Identity > Applications > Enterprise applications > All applications**. 3. Enter the name of the existing application in the search box, and then select the application from the search results. For example, **Altrata SSO**. 4. In the **Manage** section on the left menu, select **Single sign-on** to open the Single sign-on pane for editing. 5. On the **Select a single sign-on** method page, select **SAML**. 6. On the **Set up Single Sign-On with SAML **page, edit the **Basic SAML Configuration ** with the values below: **Identifier (Entity ID)** `urn:amazon:cognito:sp:us-east-2_WxqRzRqrX` **Reply URL (Assertion Consumer Service URL):** `https://auth.altrata.com/saml2/idpresponse` **Logout Url (Optional):** `https://app.altrata.com/` :inlineImage[]{src="https://api.archbee.com/api/optimize/OchO21fL_QwZk6Sym4QQl/mx6rxrBliD-V4Sh0q4Hgd_image.png" alt caption width="817" height="369"} 7. Configure the expected claims as documented above: :inlineImage[]{src="https://api.archbee.com/api/optimize/OchO21fL_QwZk6Sym4QQl/5FwHOxIwJM8wUQ8odYUMo_image.png" alt caption width="817" height="198"} 8. In the Set up **Altrata SSO** section, record the values of the Login URL, Microsoft Entra Identifier, and Logout URL properties to be shared with the Altrata team if needed. :inlineImage[]{src="https://api.archbee.com/api/optimize/OchO21fL_QwZk6Sym4QQl/1yTKDsf_WCSYK6ACdomQk_.blob" alt caption width="783" height="278"} 9. You will then need to share the resulting metadata with us, by either: \- clicking on **Download **to generate the **Federation Metadata XML**, or \- copying the **App Federation Metadata Url ** and sending it to pts\@altrata.com :inlineImage[]{src="https://api.archbee.com/api/optimize/OchO21fL_QwZk6Sym4QQl/jfb8NhTCSEyqIIEPd7_v5_image.png" alt caption width="809" height="463"} ## Testing Single Sign-On Access The Altrata team will use the metadata provided to configure the SAML SSO settings against your provisioned customer account. Once the Altrata Tech Support team has validated that SAML SSO is configured, follow these steps to test: 1. Visit https\://app.altrata.com/ 2. Enter your email address 3. As this point, you will be redirected to your Identity Provider to be authenticated using your company/corporate credentials 4. Once you are successfully authenticated, you will be authorized and redirected to your Altrata account home page: :inlineImage[]{src="https://api.archbee.com/api/optimize/OchO21fL_QwZk6Sym4QQl/lQOnV6mA7EaKpnB7BuZYR_image.png" alt caption width="856" height="569"}