Ctrlk
Useful links
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Generic Provider (SAML / OIDC)

Configure SSO with any SAML or OIDC compatible provider.

This guide explains how to configure SSO integration between Trust and any identity provider compatible with SAML 2.0 or OpenID Connect (OIDC). Use this guide for providers such as Google Workspace, Keycloak, OneLogin, among others.

Before you begin: Access Trust and copy the Identifier and Reply URL fields as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to the identity provider

  • Administrator access to Trust

  • Provider compatible with SAML 2.0 or OpenID Connect / OAuth 2.0

  • Verified corporate email domain

Choose the Protocol

SAML Configuration

Create Application in the Provider

Access your identity provider's admin panel and create a new SAML 2.0 application. The steps vary depending on the provider, but generally include:

  1. Create new SAML application / integration

  2. Select SAML 2.0 type

  3. Configure the ACS URL (Trust reply URL)

  4. Configure the Entity ID (Trust identifier)

Configure SAML Settings

Configure the following fields in the provider:

Provider Field
Value

ACS URL / Single Sign-On URL

Paste the Reply URL from Trust

Entity ID / Audience URI

Paste the Identifier from Trust

Configure Attribute Statements

Configure the attributes that will be sent to Trust:

Name
Value (example)

email

user.email

name

user.displayName

given_name

user.firstName

family_name

user.lastName

Configure Group Attribute Statements (Optional)

If you want to use custom group mapping:

Name
Value

groups

User groups (format varies by provider)

Get Metadata URL

After creating the application, copy the provider's Metadata URL. The URL generally follows a format similar to:

Tip: Some providers allow you to download the metadata XML file. In this case, you can host the file or use the direct download URL.

Important: Consult your provider's documentation to confirm the exact names of SAML attributes.

OIDC Configuration

Create Application in the Provider

Access your identity provider's admin panel and create a new OIDC / OAuth 2.0 application. The steps vary depending on the provider, but generally include:

  1. Create new application / client

  2. Select Web Application or Server-side type

  3. Configure Grant Type: Authorization Code

  4. Enter the Redirect URI (Trust reply URL)

Get Provider Credentials

After creating the application, copy the following information:

Provider Field
Description

Client ID

Unique application identifier

Client Secret

Secret key for authentication

Issuer URL

Provider base URL (discovery endpoint)

Tip: The Issuer URL can usually be found at the provider's /.well-known/openid-configuration endpoint.

Important: Consult your provider's documentation to confirm the exact names of claims.

Next Steps

After configuring the provider, return to the Trust SSO Configuration Guide to:

  1. Configure Properties and Scopes

  2. Configure Permission Groups

  3. Configure Attribute Statements

  4. Configure Domains

  5. Save and Test

Troubleshooting

Problem
Probable Cause
Solution

Redirect error

URI does not match

Verify that the reply URL is identical in both systems

Invalid token (OIDC)

Incorrect Client Secret

Verify or regenerate the Client Secret

Invalid certificate (SAML)

Expired certificate

Update the certificate in the provider and the metadata URL in Trust

Claims not received

Insufficient scopes or attributes not configured

Add the necessary scopes (OIDC) or configure the Attribute Statements (SAML)

Invalid issuer

Incorrect URL

Verify the Issuer URL at the /.well-known/openid-configuration endpoint

Signature error (SAML)

Outdated metadata

Update the Metadata URL in Trust

CORS error

Provider blocks requests

Configure allowed origins in the provider

References

Last updated