Single Sign-On (SAML)
Single Sign-On lets users whose email address is in your domains sign in through your identity provider (IdP), such as Okta, Microsoft Entra, Google Workspace, OneLogin, JumpCloud or Ping. Email one-time codes and sign-in links keep working alongside it unless you require SSO.
SAML Single Sign-On is available on the Teams and Business plans. Only an Owner or an Admin can change it. Sign in with Google, Microsoft and GitHub is available on every plan.
Before you start
- In your IdP, create a SAML application for DataLug.
- From the IdP, copy its entity ID, its SSO URL and its X.509 signing certificate in PEM format.
Set it up
Open Manage Account > Sign-in policy. The SAML settings are under Single sign-on (SAML), below the read-only passkey requirement.
Service provider details shows the two DataLug values your IdP asks for. Select Copy next to each one and paste it into the SAML application.
| Value | Where it goes in the IdP |
|---|---|
| ACS URL | The Assertion Consumer Service URL, also called the reply URL or single sign-on URL. |
| Entity ID | The service provider entity ID, also called the audience URI or identifier. |
| Field | What to enter |
|---|---|
| Display name | A name for this configuration, for example Acme SSO. |
| Email domains (comma-separated) | The domains whose users sign in through the IdP, for example acme.com, acme.co.uk. |
| IdP Entity ID | The entity ID from your IdP. |
| IdP SSO URL | The sign-in URL from your IdP. |
| IdP X.509 Certificate (PEM) | The IdP's signing certificate. Once saved it shows On file; paste a new one to replace it, or leave the field blank to keep it. |
Under Advanced:
| Field | What it does |
|---|---|
| Signature algorithm | SHA-256 (recommended), SHA-1 or SHA-512. Match your IdP. |
| Require signed assertions | Refuse an assertion that is not signed. |
| Email attribute | The assertion attribute that holds the user's email. |
| First name attribute, Last name attribute | The attributes that hold the user's names. |
Then:
- Tick Enable SSO for users in these domains.
- Select Save.
- Select Test connection. It runs once the certificate is on file. Sign in to your IdP in the new tab. When the response verifies, the tab returns to Sign-in policy and the form shows Last test passed with the time.
To change the Entity ID, SSO URL or attributes later, edit them and select Save. Leave the certificate blank to keep the one on file.
Require SSO
Once a test has passed, you can tick Require SSO for these domains. Users in those domains then cannot sign in with a one-time code. Users on other domains are unaffected.
Grace period, in days sets how long users keep the one-time code option after you require SSO. The default is 14.
How users sign in
On the sign-in page, a user enters their email. When the domain matches your configuration, DataLug offers sign-in through your IdP.
Users can also sign in from the DataLug tile in your IdP's app dashboard. DataLug accepts each IdP response once.
Remove the configuration
Select Remove configuration to delete it. Users in your domains then sign in with email one-time codes again.