This guide provides step-by-step instructions for configuring SAML SSO in Figures. It includes details on attribute mapping, automatic user account provisioning, enforcing SSO and domain-specific enforcement to ensure seamless and secure user authentication.
1. Setting Up SAML SSO
Follow the guide matching your SSO provider to setup your Entry Point URL and your Signing Certificate on the platform:
2. Attributes Mapping
Once setup and tested, you will most likely land on an error page letting you know that we had issues validating your SAML Profile.
ℹ️ Note: The first test login will fail intentionally to capture the provider's response format in order to map its attributes in Figures directly
To fix this, you need to map the user information from your identity provider (IdP) to Figures' user profiles.
How to map your SAML Attributes
Go to Settings and scroll down to the SAML SSO section
Click on Attributes Mapping tab
If you have already performed a test of the integration, you can skip to 4
Perform a test login to capture the provider’s response data by clicking on the blue button "Test integration"
Map each required Figures field to the corresponding provider attribute.
The required fields are:
Email Address
First Name
Last Name
Save your configuration and verify it by performing another test login.
Here is an example mapping:
3. Enforcing SAML SSO for your company
Enforcing SSO improves security by centralizing authentication and reducing the risk of password-related breaches. It also simplifies access management, saving time for both you and your employees.
ℹ️ Note: Users with the permission to manage SAML SSO settings will always be able to log in through other means.
3.1. Single Domain Setup
If your account is configured for a single domain, follow the steps below to enforce SSO:
Go to Settings and scroll down to the SAML SSO section
Click on the Options tab
Check the Enforce SAML SSO authentication box
Save your configuration
SSO is now enforced for your account!
3.2. Multiple Domain Setup
If your account is configured with multiple domains, such as figures.hr and figures.fr, follow the steps below to enforce SSO:
Go to Settings and scroll down to the SAML SSO section
Click on the Options tab
Check the Enforce SAML SSO authentication box
Add all domains requiring SSO authentication
Save your configuration
SSO is now enforced for your account!
4. Automatic User Account Provisioning
Enabling automatic user account provisioning with SSO streamlines onboarding by creating user accounts during their first SSO login. It ensures consistency, reduces admin workload, and eliminates manual account setup errors.
ℹ️ Note: By default, the provisioned account is as restricted as possible. This means the user's role will be set to Employee. If you need a specific role to be automatically set, you can configure your SAML provider to send the user's role along with their profile, and map them to one of Figures' (see below).
4.1. Basic Setup
Go to Settings and scroll down to the SAML SSO section
Click on the Automatic User Account Provisioning tab
Check the Enable automatic user provisioning box
Then head to the next section
4.2. User Role Mapping
Navigate to the Automatic User Account Provisioning tab
Click on the green "+ Add user role mapping" button to add a mapping line
You can create as many mappings as required
You can create multiple role mappings for 1 Figures role
Once done, continue on to the next section
4.3. Mapping Your Attributes
Navigate to Attributes Mapping tab
Optionally, you can:
Map your employee correlation field to either an employee ID or an email address
Map your provider’s role attribute for increased security
Finally, you can save the configuration and test it one more time to make sure all works accordingly
Why do we need a correlation field mapping?
For the user to have the most adapted set of permissions, we need to be able to map the incoming SSO request to one of your employees. This correlation field will help us find the corresponding employee to set up the user account. It can be their professional email address or their employee number.
