Enable Single Sign On via SAML in edoobox

With SAML Single Sign-On, admins, instructors or, depending on configuration, users sign in through an Identity Provider such as Microsoft Azure or Google Workspace. The Identity Provider authenticates the person and edoobox adopts the login using the supplied SAML data.

Please note: Subscription and support. Check whether SAML (SSO) is enabled in your edoobox account. Your subscription’s currently available features are authoritative. Coordinate technical questions about your Identity Provider with the responsible administrator.

What is SAML?

SAML stands for Security Assertion Markup Language. The Identity Provider provides secure login and sends a SAML assertion to edoobox as the Service Provider. Admins therefore do not need an additional edoobox password, provided the SAML process is configured correctly.

SAML improves security if your organisation already manages central login rules, multi-factor authentication, user lifecycles and access policies in the Identity Provider.

Clarify requirements

The edoobox subscription supports SAML; check your current subscription and whether the SAML feature is enabled in your account.
You have access to the edoobox SAML (SSO) settings.
You have administrative access to the Identity Provider.
The provider’s metadata URL or XML file is available.
You know whether permissions should be managed in edoobox or through the Identity Provider.
At least one test admin is available for checking login.
You know your edoobox account abbreviation because it is used in the SSO login URL.

Create a SAML provider in edoobox

Open Settings → SAML (SSO) → Add. Give it a clear name for the eventual login button, for example “Employee SSO”.
For Login visibility, choose between User & Admin, Admin only and User only. “User” here means participants in the booking process.
Select the appropriate NameID format: Email Address, Persistent or Unspecified. The format must match the value supplied by the provider.
Select Remote XML URL or Upload XML file and enter the IdP metadata.
For admin scope, select the fallback permission and decide on permission management and linking existing admins.
If required, configure Auth Request Signed, participant tags and offer filters. Save with Add.

Once creation succeeds, edoobox activates the provider. During introduction, restrict access at the Identity Provider to test people. An existing provider can be deactivated under Configuration → Status and reactivated after correction.

Fallback permissions, permission management and admin linking

For existing admins, enable Link admins with SAML if edoobox should link an active, not-yet-deleted person using the same email address. Identical email addresses must genuinely identify the same person.

Permission management via edoobox enables import of the mapped SAML attribute edoobox.acl into edoobox standard permissions. A valid role value must arrive in this mode. Without ACL import, maintain existing admins’ permissions in edoobox. A fallback permission alone does not authorise an arbitrary previously unknown person to obtain new admin access.

Plan the mapping using SAML data fields and admin permissions. It describes required fields, role values, additional participant fields and complete mapping examples.

Data field mapping and metadata

Open the provider from the list. Edit the available settings in the Configuration tab. In Data field mapping, check the mapping of SAML attributes to first name, last name, email and, where applicable, ACL. Edit opens the JSON representation; save a complete valid mapping.

Under Information, you can see the remote XML source, Login Service URL, Logout Service URL, expiry date and creation date. This metadata-derived information is read-only here. Download the edoobox federationmetadata.xml there and copy the Entity ID, Assertion Consumer Service and, if applicable, logout address exactly into the Identity Provider.

After changing the NameID format or signed AuthnRequests, download the current edoobox metadata again and align it with your provider. Do not copy an address from another account or environment.

For admins, copy your account’s SSO URL displayed under Settings → SAML (SSO). It contains the account abbreviation and opens the providers active for admin login. The address actually displayed takes your environment into account.

Retain a working independent superadmin login.
Open the admin SSO URL in a private browser window.
Select the provider and sign in at the Identity Provider.
Check the account, name, email and expected permissions.
Sign out and check the return route. A remaining session at the Identity Provider may make signing in again easier.

Participants start through the intended login in the booking process. Use Participant SSO, tags and offer access for this. The admin SSO URL does not replace this participant workflow.

NameID and login scope

The NameID defines which unique user identifier is used, for example an email address or persistent ID. Without a clear specification, the email address is often the most practical starting point. What matters is that the same person is reliably recognised on every login.

Depending on the provider, NameID formats such as emailAddress, persistent or unspecified can be used. Do not change this field without testing, as existing associations between the SAML account and edoobox admin may no longer match.

Login scope determines whether SAML applies to admins, users or both areas. For admin SSO, the scope must support admins or both areas. If the scope is incorrect, login appears as though the provider or user cannot be found.

Some Identity Providers require signed AuthnRequests. Only enable this option if your provider requires it, then retest metadata, login and logout. If signatures, certificates or metadata do not match, SAML login usually fails before redirection back to edoobox.

Tags, offer filters and content control

Participant tags assigned to a provider are indirectly assigned to participants linked through it. They apply to the participant identity; admins receive no tags from them. This list is maintained on the provider in edoobox. It does not automatically convert arbitrary group attributes from the Identity Provider.

With Enforce tag filtering of offers, select tags for offer access from these provider tags. Optionally, matching offers can be displayed in addition to the normal selection. Setup examples covering internal training, tag values and widget conditions are under Participant SSO, tags and offer access.

Edit or delete a provider

Open the provider and edit its name, login visibility, NameID format, permission options, signing, participant tags, offer filters and status under Configuration. Data field mapping has its own tab and saving step.

In the current interface, the original metadata URL or uploaded XML is displayed in the Information tab. It cannot be replaced directly there. If the metadata source or an uploaded IdP certificate changes and the existing source no longer supplies a current valid configuration, coordinate the transition with your SSO administrator or edoobox Support. Only delete the working provider after a successful replacement test.

edoobox requires confirmation when deleting. First check which admins and participants use this provider and have an alternative login ready.

Troubleshoot SAML logins

Login button missing: check provider status, login scope and whether the account abbreviation in the URL is correct.
Incorrect identifier or reply URL: enter the Entity ID and reply URL displayed by edoobox in the Identity Provider.
Admin not found: check email, NameID and whether Link admin is set correctly.
Missing permissions: check fallback permissions, permission management and the edoobox.acl mapping.
Only certain content visible: check automatically assigned tags, offer filters and Design Manager conditions.
Provider metadata expired: check the source and certificate; plan any required renewal with your SSO administrator and test the replacement before disabling the old setup.

NameID rejected: have a permanent identifier of at least five characters supplied. Check the actual value as well as the selected format; changing the format does not supply a missing or too-short value.

Use cases

Control permissions in the Identity Provider

The Identity Provider sends edoobox.acl. edoobox maps this attribute to the permissions field. A test admin without live-critical permissions checks that the expected permission group arrives before live admins are switched.