Single sign-on with SAML

With single sign-on (SAML), your staff sign in to SupplierVault through your own identity provider, such as Microsoft Entra ID, Okta, Google Workspace or JumpCloud. Your IT team controls who can get in and how they prove who they are. It's included in the Enterprise plan only (not the free month). On other plans, and during the free month, the Organisation tab shows "Single sign-on with your own identity provider (SAML) is included in the Enterprise plan."

How it's switched on

1. Your IT team creates a SAML app in your identity provider, using the two addresses below.
2. An admin opens Account › Organisation › Single sign-on (SAML), enters your email domains (for example yourcompany.co.uk) and the metadata URL from your identity provider, and selects Ask for single sign-on.
3. The status shows Requested, with a value starting suppliervault-verify=. To prove the domains are yours, add a DNS TXT record with this value to each domain, at the domain itself (for example yourcompany.co.uk, with the name or host set to @ or left blank). It can take a few hours to show.
4. We switch single sign-on on once every domain shows the record, and email you when it's switched on. Until then everyone signs in as they do now. You can Cancel the request.
5. When it's on, the status shows On for your domains. If it couldn't be switched on, it shows why, and you can send the request again.

The two addresses for your identity provider

Both are shown in the Organisation tab with a Copy button. Every sign-in must send the person's email address (as the Name ID in email format, and as an attribute called email).

Microsoft Entra ID

1. In the Microsoft Entra admin centre: Enterprise applications › New application › Create your own application (not in the gallery).
2. Open Single sign-on and choose SAML.
3. Under Basic SAML Configuration, set Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) to the addresses above.
4. Under Attributes & Claims, check there's an email claim with the user's email address.
5. Copy the App Federation Metadata Url from the SAML Certificates section. This is the metadata URL to give us.
6. Assign the people or groups who should use SupplierVault.

Okta

1. In the Okta Admin Console: Applications › Create App Integration › SAML 2.0.
2. Set Single sign-on URL to the ACS URL and Audience URI (SP Entity ID) to the Entity ID.
3. Set Name ID format to EmailAddress and Application username to Email. Add an attribute statement named email with the value user.email.
4. When it's saved, copy the Metadata URL from the Sign On tab, and assign people.

Google Workspace

1. In the Google Admin console: Apps › Web and mobile apps › Add app › Add custom SAML app.
2. Download the IdP metadata. Google gives a file, not a link.
3. Under Service provider details, set the ACS URL and Entity ID to the addresses above, and Name ID format to EMAIL with Name ID set to Basic Information › Primary email.
4. Map Primary email to an attribute named email, then turn the app on for your users.
5. In SupplierVault, tick My identity provider gives a metadata file, not a link, send the request, then email the file to hello@suppliervault.co.uk from your work address.

JumpCloud

1. In the JumpCloud Admin Portal: SSO Applications › Add New Application › Custom Application, and choose to configure SSO with SAML.
2. Set SP Entity ID to the Entity ID and ACS URL to the ACS URL above.
3. Set SAMLSubject NameID to email with the emailAddress format, and add an attribute named email.
4. Save, use Export Metadata (it downloads a file), and give your user groups access.
5. In SupplierVault, tick that you'll email the metadata file, send the request, then email the file to hello@suppliervault.co.uk.

Signing in with SSO

1. On the sign-in page, select Sign in with SSO (SAML).
2. Enter your work email and select Continue.
3. You're taken to your company's sign-in page, then straight back into SupplierVault.

If your email's domain isn't set up, you'll see "Single sign-on isn't set up for yourdomain. Sign in another way, or ask your IT team."

• Always start from SupplierVault's sign-in page, not a tile in your identity provider's app list.
• If you already had a SupplierVault account with the same email, your role, areas, team and settings carry over.
• To make SSO the only way in, also turn on Company sign-in only in the Organisation tab. Sign-ins through your identity provider count as company sign-ins.
• To change your identity provider or domains after it's on, email hello@suppliervault.co.uk.

Related

• Sign in with Microsoft or Google
• Add and remove people automatically
• Account, team and security
• Plans and billing