Home
Documentation
Account Configuration
SAML/SSO

Enterprise SAML/SSO Configuration

For enterprise customers, minware supports integration with SAML identity providers. minware uses Auth0 for authentication, which supports all identity providers (IdPs) that conform to the SAML 1.1. or SAML 2.0 protocol. minware also supports single sign-on with Microsoft Entra ID. See more specific instructions below:

Configuring OneLogin as SAML Identity Provider

Follow these instructions to configure OneLogin as an identity provider for minware.

Step 1: Add Application

  1. Navigate to your onelogin account at https://<domain>.onelogin.com/admin2
  2. From the menu select Applications -> Applications
  3. Select Add App
  4. Search for “SAML Custom”
  5. Select “SAML Custom Connector (Advanced)”

Step 2: Set Info

  1. Set a display name for this application, like “minware”
  2. Uncheck “Visible in portal”

Step 3: Set Configuration

  1. Select the Application you just created above
  2. Navigate to “Configuration” and fill in the following fields:
    • Audience (EntityID): urn:auth0:prod-minware:onelogin-<orgname> (replacing with your organization's "Org Handle" on your General settings page in minware)
    • ACS (Consumer) URL Validator: [-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&//=]*)
    • ACS (Consumer) URL: https://auth.minware.com/login/callback

Step 4: Set Parameters

  1. Select the Application you just created above
  2. Navigate to “Parameters”
  3. Click the “+” to add a new parameter
  4. Name the field “email”
  5. Select “Email” for value
  6. Select Include in SAML assertion
  7. Save
  8. Click the “+” to add a new parameter
  9. Name the field “name”
  10. Select “Macro” for the value
  11. Enter “{firstname} {lastname}” in the text field
  12. Select Include in SAML assertion
  13. Save

Step 5: Save SSO Fields

These values will need to be sent to support@minware to complete the authentication process.

  1. Select the Application you created above
  2. Navigate to SSO
  3. Save the following values (to view the x.509 certificate, you have to click “View Details”):
    • SAML 2.0 Endpoint (HTTP)
    • SLO Endpoint (HTTP)
    • X.509 Certificate
  4. Finally, you will need to provide:
    • The email domain(s) that you would like to login with OneLogin - These users will be redirected to OneLogin to login whenever the email domain matches.
  5. Send an email to support@minware.com with these four items to complete your setup, and we will

reach out to discuss how you would like to provision your users.

Configuring Okta as SAML Identity Provider

Follow these instructions to configure Okta as an identity provider for minware:

  1. Sign in to the Okta Developer Console.
  2. Use the App Integration Wizard to add an application for use with Auth0.
  3. Use the SAML App Wizard to create your SAML integration. When done, you'll be directed to the Sign On page for your newly-created app.
  4. Click View Setup Instructions to complete the process.
  5. Note the Identity Provider Single Sign-On URL, and download a copy of the X.509 certificate.
  6. Send an email to support@minware.com with the following. We will then reach out to discuss how you would like to provision your users.
    • Sign In URL - The Identity Provider Single Sign-On URL you noted from the Okta setup wizard
    • X509 Signing Certificate - Attach the certificate you downloaded from Okta.

Configuring Microsoft Entra ID Single Sign-On

minware supports single sign-on (SSO) with Microsoft Entra ID (formerly Azure Active Directory). Once it is set up, your team signs in to minware with their work Microsoft accounts, and you can turn off the other login methods for your organization on the Security (Login) settings page.

Existing users keep their accounts and data. Current logins keep working until SSO is switched on.

Before You Start

You will need:

  • An Entra administrator who can approve apps for your organization. This is usually a Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator.
  • Your email domains - Every email domain your users sign in with (for example, example.com and any others).

Step 1: Approve the minware App

Your Entra administrator approves the minware app for your organization. You can do this before contacting us.

  1. Sign in to Microsoft as an administrator of your organization's Entra tenant, and open the minware approval page for Microsoft Entra.
  2. Review the permissions requested by minware and select Accept.
  3. You will be returned to a minware page confirming the approval. You can close it.

Note: The approval is granted in the tenant of the account you sign in with. If your admin account is a guest in your company's tenant rather than a member of it, sign in with an account that belongs to the company's tenant.

Step 2: Contact minware Support

Send an email to support@minware.com with:

  • The email domain(s) that should sign in with Entra - Users whose email domain matches will be sent to Microsoft to sign in.
  • Confirmation that your administrator approved the minware app in Step 1.

We will set up your connection and agree on a time to switch it on, after which users with your email domains sign in through Microsoft and keep their existing minware accounts. Once it is on, users with your email domains can only sign in through Microsoft, so please have someone available to test a login, and we can switch it back right away if there is a problem.

Configuring Other Identity Providers (IdPs)

minware supports all identity providers that conform to the SAML 1.1. or SAML 2.0 protocol. Here we have specific instructions for particular identity providers, and you can contact support@minware.com for instructions if you use another identity provider. In general, you will need to provide three pieces of information to configure a SAML IdP with minware:

  • Sign In URL - The URL where SAML authentication requests are sent. This is also called the single sign-on (SSO) endpoint.
  • Sign Out URL - The URL where SAML logout requests are sent. This is also called the single logout (SLO) endpoint.
  • X509 Signing Certificate - The public-key certificate required by the SP to validate the signature of the authentication assertions that have been digitally signed by the IdP. We accept the .pem and .cer formats.

Provisioning Users

Once you have configured your SAML identity provider with minware, users will automatically be allowed to log into minware without you needing to send them invitations. Please contact us at support@minware.com to discuss how you would like to provision users. In particular, we will need to know how you would like to determine the user's role, team, and ticket system identity in minware based on the metadata available from your identity provider.

Try minware today

Start Free TrialView Live Demo