Skip to content

SAML 2.0 identity providers

Registering a SAML 2.0 identity provider (IdP) lets a customer's users sign in to MiaRec with their own identity system — Google, Microsoft Entra ID, Okta, or any SAML 2.0 provider. IdP registration is a platform-level (System tenant) task; each organization's SSO policy (enabled, mandatory, restricted domains) is customer-side — see Single sign-on in the Administration Guide.

IdPs are managed at Administration › User Authentication › SAML 2.0 — a list of registered providers with their Name, Status (Active / Not active), and Application domain, plus Add and Delete.

Tip

For Google, Microsoft, and Webex sign-in, the integration catalog (Administration › System › Integrations) offers dedicated SSO connections that are simpler to set up than a generic SAML registration.

Registering an identity provider

Click Add and fill in:

  • Status — Active to enable the provider for sign-ins.
  • Name — shown to users on the sign-in page ("Sign in with Name").
  • Application domain — the domain users type to reach the portal (without https://). MiaRec supports multiple IdPs side by side: give each customer (or group of tenants) its own subdomain — customer1.example.com, customer2.example.com — and register one IdP per domain.
  • SAML Login URL — the IdP's Single Sign-On service URL (HTTP-Redirect binding).
  • SAML Logout URL (optional) — the IdP's Single Log-Out URL; when set, signing out of MiaRec also signs the user out of the IdP.
  • Identity Provider X.509 certificate (PEM format) — paste the certificate from the IdP's metadata (the content of the X509Certificate tag, without the BEGIN/END CERTIFICATE lines).
  • Login attribute — the assertion attribute MiaRec matches against the user's login (default uid; typically set to email).

After saving, the provider's view page shows the values the IdP side needs — the service provider half of the handshake:

  • SP Entity ID and SP ACS URL (Assertion Consumer Service URL) — enter these when creating the MiaRec app in the identity provider;
  • SP Metadata URL and a Download Service Provider's metadata file link, for IdPs that accept metadata import.

Testing the configuration

On the provider's view page, click Test Single Sign-On. MiaRec sends an authentication request to the IdP and displays the raw response, including the assertion attributes the IdP returned. Confirm the attribute named in Login attribute (for example email) is present — if not, fix the attribute mapping on the IdP side.

Enabling SAML for users

A user signs in via SAML when their account's Authentication type is Single Sign-On — set it on the user form, or with Bulk Edit for many users at once (customer administrators can do this too; see User accounts). The user's Login must match the value the IdP sends in the login attribute. On first SSO sign-in, MiaRec links the IdP identity to the account; the linking rules are described in Single sign-on.