Configure Single Sign On via SAML

This guide walks through how to configure your account to use a SAML based identity provider (IDP) to let your users sign in to the Blueshift dashboard. In this example, OneLogin is used, but SAML can be configured with any identity provider that supports SAML2.0, such as G Suite.

1. Create an App in OneLogin
2. Configuring the App in OneLogin
3. Configuring Blueshift For Single Sign On
4. Using Single Sign On 
5. Okta SAML App Setup Instructions

Create an App in OneLogin

1. Go to the Administration Section
2. Go to Apps -> Add App
3. Find and select the "SAML Test Connector (IdP)" App
4. Give your app a display name (eg Blueshift Dashboard) 

Configuring the App in OneLogin

1. Open a new browser tab and navigate to https://app.getblueshift.com/dashboard#/app/account/sso
2. Copy the "Consumer Url"
3. Go to the "Configuration" tab of the newly created OneLogin SAML app
4. Paste the "ACS Consumer Url" from Blueshift into "ACS (Consumer) URL" input and the "Recipient" input of the OneLogin SAML app
5. Copy the "Entity Id" from Blueshift and paste it into the "Audience" input of the OneLogin SAML app
6. Enter https:\/\/app.getblueshift.com\/users\/auth\/saml\/callback  into the "ACS (Consumer) URL Validator*" input of the OneLogin SAML app
7. Click the "Save" button in OneLogin 

Configuring Blueshift For Single Sign On

1. Go to the "SSO" tab of the OneLogin SAML app
2. Click on "View Details" of the X.509 Certificate and copy the certificate
3. Paste the certificate into the "X.509 Certificate" field in Blueshift
4. Copy the "SAML 2.0 Endpoint (HTTP)" from OneLogin and paste it into the "SSO Provider Url" input in Blueshift
5. Click the "Save" button in Blueshift

Using Single Sign On

1. Once the SAML configuration is successfully saved, sign out of Blueshift.
2. Sign back in to Blueshift via SAML by entering your email only (no password).
3. The authentication process will automatically redirect you to sign in via the OneLogin application.

Important Note: In order to sign in to Blueshift, a user needs to be authenticated via a matching email and authorized to use the app by the Identity Provider. For example, if your email in Blueshift is john@example.com, then the OneLogin app also needs to have a user with an email of john@example.com associated with the Blueshift SAML app.

If you get locked out of your account while attempting to configure SAML single sign on, you can access the password based login via https://app.getblueshift.com/users/sign_in?pw=1.

Once you have signed in successfully via single sign-on, you should set Disable Passwords to true in Account Settings > SSO configuration tab. This ensures that the account is solely accessible via your identity provider.

Okta SAML App Setup Instructions

In the Applications Tab

1. Goto the Applications tab
   • Click "Add Application"
   • Click "Create New App"
2. Set Platform to "Web" and Sign on method to "SAML 2.0"
   • Click "Create"
3. Set App name to "Blueshift"
   • Click "Next"

In the "Configure SAML" tab

1. Copy the "ACS Consumer URL" from the blueshift SSO tab and set it as the value for the "Single sign on URL" in Okta
2. Copy the "Entity Id" from the blueshift SSO tab and set it as the value for "Audience URI (SP Entity ID)" in Okta
3. Set Name ID format to "EmailAddress"
4. Set Application username to "Email"
5. Click "Next"

In the "Feedback" tab

1. Choose "I'm an Okta customer adding an internal app"
2. Click "Finish"

In the "Sign On" tab (found in the newly created app)

1. Click "View Setup Instructions"
2. Copy the "Identity Provider Single Sign-On URL" from Okta and paste it into the
   "SSO Provider URL" field in the Blueshift dashboard SSO tab
3. Copy the "X.509 Certificate"  from Okta and paste it into the "X.509 Certificate" field in the Blueshift dashboard
4. Click "Save" in the SSO tab of the Blueshift dashboard

You're now setup. Be sure to assign your user in Okta to the newly created app via the "Assignments" tab in Okta (the users email must be an exact match of your user email in Blueshift).