Configure SAML SSO

1. In Azure AD, create an enterprise non-gallery application for Cobalt.
   • Select Enterprise applications, then select New application.
   • Select Non-gallery application.
   • Select Create your own application.
   • Enter a name for your application, then select Create.
   • Wait for the application to load.
2. Enable SSO for the application.
   • On the application page, select Set up single sign-on.
   • On the Select a single sign-on method screen, select SAML.
   • Under Basic SAML Configuration, enter:
     • Identifier (Entity ID): https://api.us.cobalt.io/users/saml/metadata
       • For EU data center: https://api.eu.cobalt.io/users/saml/metadata
     • Reply URL (Assertion Consumer Service URL): ACS URL from Cobalt (unique value for each organization).
       Copy the value in the Cobalt app in Settings > Identity & Access > Configure SAML.
     • Sign on URL: Leave this field blank.
     • Relay State: Leave this field blank.
     • Logout URL: Leave this field blank.
   • Under User Attributes & Claims, add custom attribute mappings to your SAML token attributes configuration.
     • email: user.mail
     • name: user.userprincipalname
     • Unique User Identifier: user.userprincipalname
   • The Cobalt app expects the following attributes to be passed in the SAML response:

     Name	Source Attribute
     email	user.mail

   • Under SAML Signing Certificate, download Certificate (Base 64).
   • Under Set up [Your App], copy Login URL.
3. In Cobalt, go to Settings > Identity & Access. Under Configure SAML, select Configure.
   • IdP SSO URL: Enter Login URL from Azure AD.
   • IdP Certificate: Enter Certificate (Base64) from Azure AD.
4. Test your configuration.
5. If the test is successful, assign users to the application.

1. In the Duo Admin Panel, go to Applications, and select Protect an Application. For details, read this instruction.
2. Under Metadata, copy the following values. You will need to add them to Cobalt in the next step.
   • Single Sign-On URL
   • Certificate
3. In Cobalt, go to Settings > Identity & Access. Under Configure SAML, select Configure.
   • IdP SSO URL: Enter Single Sign-On URL from Duo.
   • IdP Certificate: Enter Certificate from Duo.
4. Still in Cobalt, copy the ACS URL value, then select Save Configuration.
5. Go back to Duo. Under Service Provider, enter:
   • ACS URL: ACS URL from Cobalt.
   • Entity ID: https://api.us.cobalt.io/users/saml/metadata
     • For EU data center: https://api.eu.cobalt.io/users/saml/metadata
6. In Duo, complete the SAML Response section with:
   • NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   • NameID attribute: mail
   • Signature algorithm: SHA256
   • Signing options: Select Sign response and Sign assertion.
   • Map attributes:
     • IdP Attribute: mail
     • SAML Response Attribute: email
7. Complete other required steps.
8. Assign users to the application.
9. Test the integration.

1. In the Google Admin console, go to Menu > Apps > Web and mobile apps. Follow this instruction for more details.
2. Select Add App > Add custom SAML app.
3. On the App Details page, enter general information for the integration, then select Continue.
4. On the Google Identity Provider details page, locate the following values. You will need to add them to Cobalt in the next step.
   • SSO URL
   • Certificate
5. In Cobalt, go to Settings > Identity & Access. Under Configure SAML, select Configure.
   • IdP SSO URL: Enter SSO URL from the Google Admin console.
   • IdP Certificate: Enter Certificate from the Google Admin console.
6. Still in Cobalt, copy the ACS URL value, then select Save Configuration.
7. Go back to the Google Admin console. In the Service Provider Details window, enter:
   • ACS URL: ACS URL from Cobalt
   • Entity ID: https://api.us.cobalt.io/users/saml/metadata
     • For EU data center: https://api.eu.cobalt.io/users/saml/metadata
8. Leave the Signed Response option unselected (default).
9. On the Attribute Mapping page, add an attribute email, and select Basic Information and Primary Email.
10. Complete other required steps.
11. Test the integration.
12. If the test is successful, assign users to the application.

For more information on how to create a non-gallery app, refer to the Okta documentation.

To create a non-gallery SAML app for Cobalt in Okta:

1. In Cobalt, go to Settings > Identity & Access. Under Configure SAML, select Configure. You will need the following values in the next steps:
   • ACS URL
   • Entity ID
     
     
2. In Okta, in the Admin Console, go to Applications > Applications.
3. Select Create App Integration.
4. In the overlay that appears, select SAML 2.0 as the sign-in method, and then select Next.
5. On the General Settings tab, enter general information for the integration, then select Next.
6. On the Configure SAML tab, under General, enter SAML details:
   • Single sign-on URL: Enter ACS URL from Cobalt.
   • Audience URI (SP Entity ID): Enter https://api.us.cobalt.io/users/saml/metadata.
     • For EU data center: https://api.eu.cobalt.io/users/saml/metadata
   • Leave the Default RelayState field blank.
   • For other fields, use default values.
     
     
7. Still on the Configure SAML tab, under Attribute Statements (optional), add the following mapping attribute:
   • email: user.email
     
     
8. Select Next.
9. On the Feedback tab, select I’m an Okta customer adding an internal app, and then select Finish.
10. Once you’ve created a SAML application, on the Sign on tab, under Metadata details, click More details.
    You need the following values to complete the configuration in Cobalt:
    • Sign on URL
    • Signing Certificate
      
      
11. In Cobalt, enter the following values from Okta, and then select Save Configuration.
    • IdP SSO URL: Enter Sign on URL from Okta.
    • IdP Certificate: Enter Signing Certificate from Okta.
12. Test the integration.
13. If the test is successful, assign users to the application.

1. Create a custom application connector for Cobalt. Follow OneLogin instructions to build a SAML Custom Connector (Advanced).
2. In OneLogin, enter the following values for configuration parameters:
   • Audience (EntityID): https://api.us.cobalt.io/users/saml/metadata
     • For EU data center: https://api.eu.cobalt.io/users/saml/metadata
   • Recipient, ACS (Consumer) URL Validator, and ACS (Consumer) URL: ACS URL (unique value for each organization).
     Copy the value in the Cobalt app in Settings > Identity & Access > Configure SAML.
   • SAML initiator: OneLogin
   • SAML nameID format: Email
   • SAML issuer type: Specific
   • SAML signature element: Assertion
3. In OneLogin, navigate to your application connector. On the SSO tab, under SAML Signature Algorithm, select SHA-256.
4. In Cobalt, go to Settings > Identity & Access. Under Configure SAML, select Configure.
   • IdP SSO URL: Enter SAML 2.0 Endpoint (HTTP) from OneLogin.
   • IdP Certificate: Enter X.509 Certificate from OneLogin.
     You can find these parameters in OneLogin on the SSO tab of your application connector.
5. Navigate to your application connector in OneLogin. On the Parameters tab, select Add Parameter.
   • Under Field name, enter email, then select Include in SAML assertion, and select Save.
   • Under Value, select Email, and select Save.
6. To test your configuration, sign in to OneLogin as your assigned user. You should see a custom application for Cobalt that you configured.
7. Select this application to sign in to Cobalt.
8. If the test is successful, assign users in OneLogin:
   • Go to Administration.
   • In the menu, select Users > Users.
   • Assign users to your application.