Article

    SAML SSO Setup Guide

    7 min read
    Last updated 1 week ago

    Overview

    Chezie supports SAML 2.0 single sign-on so your employees log in to Chezie with your company's identity provider (IdP). Your IdP (Microsoft Entra ID, Okta, Google Workspace, PingFederate or any SAML 2.0 provider) authenticates the user, then sends Chezie a signed assertion with their email and profile attributes.

    In this setup your IdP is the Identity Provider and Chezie is the Service Provider (SP). Login is SP-initiated: a user enters their work email on Chezie, is redirected to your IdP, and lands back in Chezie once authenticated.

    Before you begin

    You need admin access to your IdP and your Chezie subdomain (set during onboarding). When setup is done, send the Chezie team:

    • Your IdP metadata (XML file or metadata URL)
    • Your company's email domain(s), e.g. yourcompany.com
    • Which environment you are connecting: staging, production, or both

    Send these to your Chezie contact or gasper@chezie.co.

    Chezie service provider details

    Use these values wherever your IdP asks for the SP's Entity ID, ACS (Reply) URL or Logout URL. Configure staging first if you are testing before go-live.

    SettingStagingProduction
    ACS URL (Reply URL / Single sign-on URL)https://qtiecfyollslwhqphlwg.supabase.co/auth/v1/sso/saml/acshttps://ajpslxczqsiotagnzifa.supabase.co/auth/v1/sso/saml/acs
    Entity ID / metadata URL (Audience URI)https://qtiecfyollslwhqphlwg.supabase.co/auth/v1/sso/saml/metadatahttps://ajpslxczqsiotagnzifa.supabase.co/auth/v1/sso/saml/metadata
    SLO URL (Single logout)https://qtiecfyollslwhqphlwg.supabase.co/auth/v1/sso/slohttps://ajpslxczqsiotagnzifa.supabase.co/auth/v1/sso/slo
    Login domainqtiecfyollslwhqphlwg.supabase.coajpslxczqsiotagnzifa.supabase.co

    SP metadata XML: add ?download=true to the metadata URL to download Chezie's SP metadata file, e.g. https://ajpslxczqsiotagnzifa.supabase.co/auth/v1/sso/saml/metadata?download=true. Many IdPs can import this file instead of entering the URLs by hand.

    Signing certificate: Chezie's SSO certificate is included in the entity metadata.

    Configuration requirements

    These apply to every IdP. The email attribute is the one setting SSO cannot work without.

    RequirementValueNotes
    email attributeUser's work emailRequired. Send it as an attribute named exactly email, unique per user.
    first_name, last_name attributesUser's first and last nameRecommended, so profiles are populated on first login.
    SAML subject (NameID)Email address, or your IdP's default identifierEmail is the usual choice. A persistent ID such as PingFederate's fmFederationID also works, as long as the email attribute is sent.
    Assertion signingSignedSign your assertions. Encryption is optional.
    SSO flowSP-initiatedUsers start login from Chezie.

    IDP-Specific Instructions

    Microsoft Entra ID (Azure AD)

    1. In the Azure portal, go to Enterprise applications > New application > Create your own application. Name it "Chezie" and choose a non-gallery app.

      image.png

    2. Open Single sign-on and select SAML.

    3. Under Basic SAML Configuration, set Identifier (Entity ID) to the metadata URL and Reply URL to the ACS URL.

    4. Set Sign on URL to your Chezie subdomain.

    5. Under Attributes & Claims, add a claim named email mapped to user.mail (plus first_name and last_name if desired).

    6. Download the Federation Metadata XML and send it to Chezie with your email domain.

    7. Assign users or groups. Chezie then appears in their My Apps dashboard.

    Okta

    1. In the Okta admin dashboard, go to Applications > Create App Integration and choose SAML 2.0.

    2. Add the app name ("Chezie") and logo.

      Full logo - blue orange.png

    3. Set Single sign-on URL to the ACS URL and check Use this for Recipient URL and Destination URL.

    4. Set Audience URI (SP Entity ID) to the metadata URL.

    5. Set Name ID format to EmailAddress and Application username to Email.

    6. Under Attribute Statements, add email mapped to user.email.

    7. Select I'm an Okta customer adding an internal app and finish.

      image.png

    8. Copy the SAML 2.0 Metadata URL and send it to Chezie with your email domain.

    9. Optional: create a Bookmark app pointing to your Chezie subdomain, hide the SAML app from users, and assign the bookmark instead.

    Google Workspace

    1. In the Google Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app.

    2. Add the app name, description and logo.

    3. Download the IdP metadata file and send it to Chezie with your email domain.

    4. Set ACS URL and Entity ID from the table above, and Start URL to your Chezie subdomain. Set Name ID format to EMAIL.

    5. Under Attribute mapping, map Primary email to email.

    6. Turn the app ON for everyone (or selected org units). Chezie then appears in users' Google apps menu.

    PingFederate

    1. In the PingFederate Admin Console, create a new SP Connection using the Browser SSO profile, SAML 2.0, with SP-initiated SSO.
    2. Name the connection (e.g. "Chezie SAML"). Import Chezie's SP metadata XML, or enter the Entity ID and ACS URL manually.
    3. Under Assertion Creation, keep the SAML subject as fmFederationID (or use email address).
    4. Under Attribute Contract, add email (required), first_name and last_name, mapped from your directory (LDAP, Active Directory or similar).
    5. Under Signature Policy, sign the assertion. Encryption is optional.
    6. Export the IdP metadata XML and send it to Chezie with your email domain.
    7. Activate the connection for the target users or groups.

    Other SAML 2.0 providers

    Any SAML 2.0 IdP works. Import Chezie's SP metadata XML (or enter the ACS URL and Entity ID manually), send the email attribute, sign assertions, and send Chezie your IdP metadata.

    Testing and go-live

    Once Chezie confirms your IdP metadata is loaded, test with one user before rolling out.

    1. Go to your Chezie login page and enter a work email on your configured domain.
    2. Confirm you are redirected to your IdP, authenticate, and land back in Chezie signed in.
    3. Check the profile shows the correct email and name.
    4. Assign the app to the rest of your users or groups.

    Troubleshooting

    • Login fails after authenticating: the email attribute is usually missing or misnamed. It must be named exactly email.
    • Not redirected to your IdP: confirm Chezie has your email domain on file.
    • Signature or audience error: check the Entity ID and ACS URL match the environment (staging vs production) and that assertions are signed.