SAML SSO

Single sign-on (SSO) allows users of your Cryptlex account to log in using your existing SAML-enabled identity provider, such as Active Directory, OneLogin, Auth0, and Okta. This reduces the number of passwords your users need to manage and simplifies provisioning new users.

SAML SSO can be configured at two levels:

• Account level: Your team members configure SAML SSO for your Cryptlex account using your identity provider, covering admin portal login and, through role mapping, customer and reseller portal login.
• Organization level: An organization admin can configure SAML SSO for their own organization from the customer portal, so the organization's users log in to the customer portal with the organization's own identity provider.

Configuring account-level SAML SSO

To get started, go to the Settings -> Account page in the admin portal and click the Configure SAML SSO button. This displays the SAML SSO settings dialog where you can add details of your identity provider.

Cryptlex supports the SAML 2.0 standard. Each identity provider has its own interface and nuances, but most provide configuration metadata as a URL, so this article covers configuration with a generic SAML identity provider.

The easiest way to configure SSO is to use a link to your identity provider's metadata file. Enter the URL in the SAML IdP Metadata URL input box and click Save. Cryptlex downloads the configuration file, parses it, and configures everything.

Auto-provisioning users

The SAML identity provider must be configured to provide four attributes: Email, FirstName, LastName, and Role. These attributes allow Cryptlex to identify and automatically provision users.

Email

Every user in your Cryptlex account is required to have a valid email address, even when using SSO. Since the identity provider is responsible for managing user information, it must send the user's email address to Cryptlex in its assertion. Identity providers use different naming conventions, so Cryptlex will look for an email address in the following attributes (case-insensitive) sequentially:

• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
• EmailAddress
• Email
• Mail
• User.email
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

FirstName

Just like email addresses, identity providers may send the first name in several common fields. To provide out-of-the-box compatibility with most identity providers, Cryptlex will try to find the first name in the following attributes (case-insensitive):

• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
• FirstName
• first_name
• User.FirstName

LastName

Cryptlex looks for the last name in the following attributes (case-insensitive):

• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
• LastName
• last_name
• User.LastName

Role

If your identity provider supports custom attributes, you can set the Role attribute to automatically provision users with roles created in Cryptlex. Cryptlex looks for the role in the following attributes (case-insensitive):

• http://schemas.microsoft.com/ws/2008/06/identity/claims/role
• Role

Role mapping

You can map the roles created in Cryptlex (service provider roles) to your existing roles in the identity provider. Depending on the identity provider role in the SAML assertion, Cryptlex uses the corresponding service provider role when auto-provisioning the user.

Configuring organization-level SAML SSO

Organization admins can set up SAML SSO for their organization from the customer portal, using the organization's own identity provider. Once configured, users belonging to the organization authenticate against that identity provider when logging in to the customer portal, instead of using Cryptlex credentials or your account-level identity provider.