This guide explains how to integrate any SAML 2.0 compatible application with Fixiam as the Identity Provider (IdP).

After completing this guide, users will be able to authenticate to their application using their Fixiam credentials through Single Sign On (SSO).

Prerequisites

Before you begin, ensure you have the following:

Access Requirements

• Administrator access to Fixiam.
• Administrator access to the application you are integrating.

Information Required from the Service Provider (SP)

Obtain the following information from your application's SAML documentation or administrator:

• Assertion Consumer Service (ACS) URL
• Entity ID (Audience URI)
• Single Logout (SLO) URL (Optional)
• Required NameID format
• Required user attributes (Email, First Name, Last Name, Groups, etc.)

SAML Integration Overview

The integration consists of the following steps:

1. Create a Custom SAML Application in Fixiam.
2. Configure the Service Provider details.
3. Configure user attribute mappings.
4. Exchange metadata between Fixiam and the Service Provider.
5. Grant users access to the application.
6. Test the integration.

Step 1: Create a Custom Application

1. Sign in to the Fixiam Admin Portal.
2. Navigate to Applications.
3. Click Create Application.
4. Select Custom Application.
5. Enter an application name.
6. Optionally upload an application logo.
7. Select SAML as the authentication protocol.
8. Click Next.

Step 2: Configure the Service Provider

Provide the information supplied by the application you are integrating.

Assertion Consumer Service (ACS) URL

The ACS URL is the endpoint where Fixiam sends the SAML authentication response after a user successfully signs in.

Example

https://app.company.com/saml/acs

Entity ID

The Entity ID uniquely identifies the Service Provider.

This value must exactly match the Entity ID configured in the application.

Example

https://app.company.com

Single Logout (SLO) URL (Optional)

If supported by the application, the Single Logout URL enables users to sign out from both Fixiam and the application using a single logout action.

Example

https://app.company.com/logout

Download Metadata

You can provide the metadata to your Service Provider using one of the following options:

• Export Metadata to download the metadata XML file.

• Copy Metadata URL to share the metadata endpoint with applications that support metadata URL import.

• Copy the IdP Entity ID displayed on the page for manual configuration.

  Values include:

  • Identity Provider Entity ID
  • Single Sign On (SSO) URL
  • X.509 Signing Certificate

Step 3: Configure Attribute Mapping & Name ID format

• NameID Format

  Select the NameID format expected by your application.

  Common options include:

  • Email Address
  • Persistent
  • Transient
  • Unspecified
    Refer to your application's SAML documentation to determine the correct format.

• Attribute Mapping

Attribute mapping determines which user information Fixiam sends to the application after successful authentication.

Configure the required attributes based on your application's requirements.

A typical configuration is shown below.

Note

Some applications require specific attribute names. Always refer to the application's SAML documentation when configuring attribute mappings.

>

Step 4: Save the Application and Exchange Metadata

After completing the configuration:

1. Review your settings.
2. Click Save.

Saving the application in Fixiam completes the Identity Provider (IdP) configuration. The integration is not complete until the Service Provider (SP) is also configured.

After saving the application:

1. Sign in to your Service Provider's administration portal.
2. Create or edit the SAML Single Sign On (SSO) configuration.
3. Configure the Service Provider using the metadata generated by Fixiam.
4. Depending on your Service Provider, either:
   • Upload the Fixiam Metadata XML.
   • Import the Fixiam Metadata URL.
   • Manually enter the Fixiam IdP Entity ID, Single Sign On (SSO) URL, and X.509 Signing Certificate.
5. Save the configuration in your Service Provider.
6. Return to Fixiam to assign users or groups to the application and test the integration.

Note

The service provide refers to the application you want to configure single sign on.

Step 5: Grant Users Access to the Application

Successfully configuring SAML establishes trust between Fixiam and the application.

However, users must also be granted access before they can successfully sign in.

The recommended approach is to assign applications through groups.

Create a Group

1. Navigate to Groups.
2. Click Create Group.
3. Enter a group name.
4. Click Save.

Assign the Application to the Group

1. Open the newly created group.
2. Navigate to the Applications tab.
3. Click Assign Application.
4. Select the SAML application you created.
5. Save your changes.

Add a Test User

1. Open the users tab.
2. Click Add Member.
3. Select a test user.
4. Save your changes.

Note

A user must belong to a group that has been assigned the application before they can access it through Single Sign On.

Step 6: Test the Integration

1. Sign in as the test user.
2. Launch the application.
3. You should be redirected to Fixiam.
4. Authenticate using your Fixiam credentials.
5. Upon successful authentication, you should be redirected back to the application.
6. Confirm that access is granted.

Verification Checklist

Confirm the following before considering the integration complete.

• The Custom SAML Application has been created.
• Service Provider details have been configured correctly.
• User attributes have been mapped successfully.
• Fixiam metadata has been exchanged with the Service Provider.
• The application has been configured successfully.
• A group has been created.
• The application has been assigned to the group.
• A test user has been added to the group.
• The test user can authenticate successfully.
• The user is redirected back to the application after authentication.
• The correct user profile is available within the application.

Troubleshooting

Error: Invalid Audience

Cause

The Entity ID configured in Fixiam does not match the Entity ID configured in the Service Provider.

Resolution

Verify that both Entity IDs are identical.

Error: Invalid Signature

Cause

The Service Provider is using an outdated or incorrect signing certificate.

Resolution

Download the latest Fixiam metadata and update the Service Provider.

Error: User Not Found

Cause

The user has not been granted access to the application.

Resolution

Verify that the user belongs to a group that has been assigned the application.

Error: Missing Attributes

Cause

Required attribute mappings have not been configured correctly.

Resolution

Review the attribute mappings and ensure all mandatory attributes are configured.

Error: NameID Mismatch

Cause

The application expects a different NameID format.

Resolution

Update the NameID format in Fixiam to match the requirement of the Service Provider.

SAML Authentication Flow

User
   │
   ▼
Application (Service Provider)
   │
Redirects user to Fixiam
   │
   ▼
Fixiam (Identity Provider)
   │
Authenticates user
   │
Generates SAML Response
   │
   ▼
Application
   │
Grants Access

Need Help?

If you experience issues during configuration, verify that:

• All Service Provider values are entered correctly.
• The metadata has been exchanged successfully.
• Required attributes are mapped correctly.
• The application has been assigned to a group.
• The user belongs to a group with access to the application.
• The Service Provider supports the selected NameID format.

Once these checks are complete, your SAML Single Sign On integration with Fixiam should be ready for use.