Add Federated and SSO Authentication

how-to

Add federated authentication with single sign-on (SSO) to your Couchbase Capella organization.

To add federated and SSO authentication, you must create a realm in Capella. A realm manages the configuration of the link between Capella and your IdP. Each organization supports one realm.

This page walks you through the process of creating a realm and configuring your IdP to add federated and SSO authentication to your organization.

Access and Enable SSO Settings

You can manage federated and SSO authentication from the SSO page in your organization’s settings.

You are only able to see the SSO page if you have the Organization Owner role in your organization.

Navigate to the SSO page in Organization Settings:
1. In the Capella UI, on the navigation bar, click the Settings tab.
2. In the navigation menu, click SSO.
Enable SSO:

If not already enabled, enable federated and SSO authentication options by contacting Couchbase. You can do this automatically through the SSO page.
1. On the SSO page, click Enable SSO.
2. In the Enable SSO dialog box, click Create Support Ticket.
  
  The SSO page remains unchanged until support enables SSO for your organization.

Configure Federated and SSO Authentication

While you can configure Capella with other SAML identity providers, Couchbase provides instructions and support for Microsoft Azure AD, Okta, Ping Identity, CyberArk, Google Workspace, and OneLogin.

Choose the tab corresponding to your IdP.

Prerequisites

To configure Azure Active Directory (Azure AD) as an IdP, you need:

SSO enabled for your Capella organization.
An Azure Subscription. For more information, see the Microsoft Azure portal.
An Azure AD tenant associated with your Azure subscription. For more information, see the Azure AD Documentation.
Global Administrator privileges for your Azure AD tenant.

Procedures

To configure federated and SSO authentication using Azure AD as your identity provider (IdP), you must complete three procedures in the following order:

In Azure AD, register an Azure AD application
In Capella, create a realm
In Azure AD, complete the configuration

Start by registering an application with Azure AD. Information generated by this step is required to create a realm in Capella.

From the Azure portal, open the Azure Active Directory service.
From the navigation pane, click App registrations.
Click New registration.
Configure options on the Register an application page:
1. Name: Enter the display name you want for this application.
Click Register.

The Overview page of the app appears once it’s registered.

Create a Realm in Capella

With an Azure AD app registered, you need to create a realm in Capella that requires some information from Azure AD.

In Capella, Navigate to the SSO page in Organization Settings:
1. In the Capella UI, on the navigation bar, click the Settings tab.
2. In the navigation menu, click SSO.
Click Create Realm.
Complete the Create Realm page:
1. In Azure AD, on the Overview page of the app you registered, click Endpoints to open the Endpoints flyout.
2. Copy and paste the X.509 certificate from Azure AD to Capella:
  1. In the Endpoints flyout, copy the contents of the Federation metadata document field.
  2. Paste this URL into a new browser tab to view this XML document.
  3. From the XML document, copy the certificate within the <X509Certificate>…</X509Certificate> tag.
  4. In Capella, paste the certificate contents into the SAML Signing Certificate text box.
3. Copy SAML - P sign-on endpoint from Azure AD to Capella.
  1. In Azure AD, with the Endpoints flyout open, copy the contents of the SAML -P sign-on endpoint field.
  2. In Capella, paste the SAML -P sign-on endpoint into the Sign-in Endpoint URL field.
4. Verify that the remaining SAML protocol settings are as follows:
  
  Field Value
  
  Signature Algorithm
  
  RSA-SHA256
  
  Digest Algorithm
  
  SHA256
  
  SAML Protocol Binding
  
  HTTP-POST
5. Choose a default team.
  
  Capella automatically assigns users to the chosen default team when they don’t match any team based on their SSO groups. All users assigned to the default team have its chosen permission set.
  
  See Manage Capella Role Mapping for information about Teams and how to configure their permissions.
6. Choose to enable or disable group mapping.
  
  Capella enables group mapping by default. Group mapping allows you to assign roles to SSO users based on which teams map to their SSO group. If you disable group mapping, Capella uses the default team to give SSO users their roles when they first sign in. After SSO users sign in, you manage them like other Capella users through the People tab and each project’s Collaborators tab.
Click Create Realm.

Capella creates the new realm with an auto-generated name.

Users need to know the realm name to sign in with SSO.

Field	Value
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
SAML Protocol Binding	HTTP-POST

Complete the Azure AD Configuration

Now that you have created the realm, you need to finish configuring Azure to include the Application ID, Redirect URI, and optional claim information.

In Capella, open the information page for the realm that you created if it isn’t already.
1. Open the Settings SSO page.
2. Click the listed realm to open its information page.
Add the Application ID URL:
1. In Capella, on the realm information page, copy the Entity ID field.
2. In Azure AD, on the Overview page of the app you registered, click the Add an Application ID URI link.
3. Click Set.
4. In the Set the App ID URI dialog box, paste the Entity ID field you just copied from Capella.
5. Click Save.
Add the Redirect URI:
1. In Capella, on the realm information page, copy the Callback URL field.
2. In Azure AD, on the Overview page of the app you registered, click the Add a Redirect URI link.
3. Click Add a platform.
4. In the Configure platforms flyout, click the Single-page application tile.
5. In the Configure single-page application flyout, paste Callback URL into the Redirect URIs field.
6. Check the ID tokens (used for implicit and hybrid flows) checkbox.
7. Click Configure.
Add optional claims:
1. In Azure AD, in the navigation, click Token configuration.
2. Click Add groups claim.
3. In the Edit groups claim flyout, select all the group types.
4. Click Add.
5. On the Optional claims page, click Add optional claim.
6. In the Add optional claim flyout, choose the SAML option.
7. Check the checkbox for the email claim.
8. Click Add.
9. In the dialog box, select the Turn on the Microsoft Graph email permission box.
10. Click Add.

Prerequisites

To configure Okta as an IdP, you need:

SSO enabled for your Capella organization.
An Okta account.
Signed in to the Okta Admin Console as a super admin.

Procedures

To configure federated and SSO authentication using Okta as your identity provider (IdP), you must complete three procedures in the following order:

In Okta, create an App Integration
In Capella, create a realm
In Okta, complete the configuration

Create an Okta App Integration

Start by creating an App Integration in Okta. Information generated by this step is required to create a realm in Capella.

In the Okta Admin Console, click Applications.
Click Create App Integration.
For the sign-in method, choose SAML 2.0.
Click Next.
Configure the options on the General Settings page:
1. App Name: Enter your desired application name.
2. (Optional) App logo: Add the Capella logo.
3. (Optional) App visibility: Adjust if you don’t want to show the Capella app to users in Okta.
4. Click Next.

Configure the options on the Configure SAML page:

Add the following placeholders:

Field Value

Field	Value
Single Sign-On URL	Enter a placeholder, such as `https://placeholder`. You’ll provide the real value in a later step.
Audience URI (SP Entity ID)	Enter a placeholder, such as `uri:placeholder`. You’ll provide the real value in a later step.

Single Sign-On URL

Enter a placeholder, such as https://placeholder. You’ll provide the real value in a later step.

Audience URI (SP Entity ID)

Enter a placeholder, such as uri:placeholder. You’ll provide the real value in a later step.

Click Show Advanced Settings.

Verify that the advanced settings have the following values:

Field Value

Response

Signed

Assertion Signature

Signed

Signature Algorithm

RSA-SHA256

Digest Algorithm

SHA256

Assertion Encryption

Unencrypted
In the Attribute Statements (optional) section, create the following three attributes:

Values entered into the Name column are case-sensitive. Enter them as shown in the table.

Name Name format Value

email

Unspecified

user.email

given_name

Unspecified

user.firstName

family_name

Unspecified

user.lastName
In the Group Attribute Statements (optional) section, create the following attribute:

Name Name format Filter Filter Value

groups

Basic

Matches regex

.*

This filter matches all group names associated with a user. You can filter the groups names sent to Capella further by adjusting the Filter and Filter Value.
Click Next.

Complete the Feedback page:
1. Choose I’m an Okta customer adding an internal app.
2. Add any further feedback if desired.
3. Click Finish.

Field	Value
Response	Signed
Assertion Signature	Signed
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
Assertion Encryption	Unencrypted

Name	Name format	Value
`email`	Unspecified	`user.email`
`given_name`	Unspecified	`user.firstName`
`family_name`	Unspecified	`user.lastName`

Name	Name format	Filter	Filter Value
`groups`	Basic	Matches regex	`.*`

Create a Realm in Capella

With an Okta integration app created, you need to create a realm in Capella that requires some information from Okta.

In Capella, navigate to the SSO page in Organization Settings:
1. In the Capella UI, on the navigation bar, click the Settings tab.
2. In the navigation menu, click SSO.
Click Create Realm.
Complete the Create Realm page:
1. Copy the following fields from your Okta configuration to Capella:
  
  To find this information in Okta, first open the Sign On tab. Within the SAML Setup section of this page, click View SAML setup instructions.
  
  Okta Field Capella Field
  
  X.509 Certificate
  
  SAML Signing Certificate
  
  Identity Provider Single Sign-On URL
  
  Sign-in Endpoint URL
2. Verify that the remaining SAML protocol settings are as follows:
  
  Field Value
  
  Signature Algorithm
  
  RSA-SHA256
  
  Digest Algorithm
  
  SHA256
  
  SAML Protocol Binding
  
  HTTP-POST
3. Choose a default team.
  
  Capella automatically assigns users to the chosen default team when they don’t match any team based on their SSO groups. All users assigned to the default team have its chosen permission set.
  
  See Manage Capella Role Mapping for information about Teams and how to configure their permissions.
4. Choose to enable or disable group mapping.
  
  Capella enables group mapping by default. Group mapping allows you to assign roles to SSO users based on which teams map to their SSO group. If you disable group mapping, Capella uses the default team to give SSO users their roles when they first sign in. After SSO users sign in, you manage them like other Capella users through the People tab and each project’s Collaborators tab.
Click Create Realm.

Capella creates the new realm with an auto-generated name.

Users need to know the realm name to sign in with SSO.

Okta Field		Capella Field
X.509 Certificate		SAML Signing Certificate
Identity Provider Single Sign-On URL		Sign-in Endpoint URL

Field	Value
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
SAML Protocol Binding	HTTP-POST

Complete the Okta Configuration

Now that you have created the realm, you need to configure Okta to replace the placeholder values that you used.

In the Okta Console, open the Couchbase Capella app you created to the General tab.
Inside the SAML Settings section, click Edit.
On the General Settings page, click Next.

Edit the options on the Configure SAML page:

Copy the following fields from your Capella realm configuration to the Okta configuration:

To find this information for your organization’s Capella realm, first open the SSO page. Listed on this page is the realm that you just created with an auto-generated name. Click its listing to open the realm information page.

Capella Field		Okta Field
Callback URL		Single sign on URL
Entity ID		Audience URI (SP Entity ID)

Capella Field

Okta Field

Callback URL

Single sign on URL

Entity ID

Audience URI (SP Entity ID)

Click Next.
Click Finish.
Assign users to the Capella app integration.
1. On the Okta application page, click the Assignments tab.
2. Make sure that all your Capella organization users who use the Okta service are enrolled. See the Assign an app integration to a user page of the Okta documentation for more detail.

Prerequisites

To configure Ping as an IdP, you need:

SSO enabled for your Capella organization.
A Ping account.
To be signed in to the Ping admin console as an admin.

Procedures

To configure federated and SSO authentication using Ping as your identity provider (IdP), you must complete three procedures in the following order:

In Ping, create an Application
In Capella, create a realm
In Ping, complete the configuration

Add a Ping Application

Start by creating a Ping Application in the Ping admin console. You need the information from this step to create a realm in Capella.

Create a key pair:
1. In the Ping admin console, click Connections Certificates & Key Pairs.
2. Click Add Create Key Pair.
3. In the Create Key Pair form, enter the following:
  - Common Name: Enter a name for the new key pair.
  - Usage Type: Choose Signing - Verification.
  - Organization: Enter an organization name.
  - Country: Enter your country.
4. Click Save & Finish.
Click Applications.
Create the application:
1. Click the plus sign icon.
2. Fill in the following fields:
  - Application Name: Add a unique application name.
  - (Optional) Description: Add a description of the application.
  - (Optional) Icon: Add the Capella logo.
  - Choose Application Type: Select SAML Application.
3. Click Configure.

Start the SAML configuration:

Choose Manually Enter.

Add the following placeholders:

Field Value

Field	Value
ACS URLs	Enter a placeholder, such as `https://example.com`. You’ll provide the real value in a later step.
Entity ID	Enter a placeholder, such as `placeholder`. You’ll provide the real value in a later step.

ACS URLs

Enter a placeholder, such as https://example.com. You’ll provide the real value in a later step.

Entity ID

Enter a placeholder, such as placeholder. You’ll provide the real value in a later step.

Click Save.

Add attributes:
1. Click the Attributes button containing the pencil icon.
2. In the Attribute Mapping section, add the following attributes using the + Add button:
  
  Attributes PingOne Mappings Required
  
  saml_subject
  
  User ID
  
  email
  
  Email Address
  
  family_name
  
  Family Name
  
  given_name
  
  Given Name
  
  groups
  
  Group Name
  
  ^{The saml_subject attribute is a default attribute that you can’t remove.}
3. Click Save.
Click the Overview tab.
Update the SAML configuration with signing key information:
1. Click the Protocol button containing the gear icon.
2. In the Configuration section, enter or edit the following fields:
  
  Field Value
  
  Signing Key
  
  The name of the signing key you created.
  
  Signing Algorithm
  
  RSA_SHA256
3. Click Save.
Near the top right corner of the details panel, enable the application by clicking the toggle switch.

Attributes	PingOne Mappings	Required
`saml_subject`	`User ID`
`email`	`Email Address`
`family_name`	`Family Name`
`given_name`	`Given Name`
`groups`	`Group Name`

Field	Value
Signing Key	The name of the signing key you created.
Signing Algorithm	`RSA_SHA256`

Create a Realm in Capella

With a Ping application created, you need to create a realm in Capella using information from Ping.

In Capella, open the SSO page:
1. In the Capella UI, click the Settings tab.
2. In the navigation menu, click SSO.
Click Create Realm.
Complete the Create Realm page:
1. Copy the following information from your Ping configuration to Capella:
  
  To find this information in the Ping admin console, go to Connections Applications. Find and click the application that you want to view. In the details panel, click the Configuration tab.
  
  Ping Field Capella Field
  
  Contents of Download Signing Certificate X509 PEM (.crt)
  
  SAML Signing Certificate
  
  Single Signon Service
  
  Sign-in Endpoint URL
2. Verify that the remaining SAML protocol settings are as follows:
  
  Field Value
  
  Signature Algorithm
  
  RSA-SHA256
  
  Digest Algorithm
  
  SHA256
  
  SAML Protocol Binding
  
  HTTP-POST
3. Choose a default team.
  
  Capella automatically assigns users to the chosen default team when they don’t match any team based on their SSO groups. All users assigned to the default team have its chosen permission set.
  
  See Manage Capella Role Mapping for information about Teams and how to configure their permissions.
4. Choose to enable or disable group mapping.
  
  Capella enables group mapping by default. Group mapping allows you to assign roles to SSO users based on which teams map to their SSO group. If you disable group mapping, Capella uses the default team to give SSO users their roles when they first sign in. After SSO users sign in, you manage them like other Capella users through the People tab and each project’s Collaborators tab.
Click Create Realm.

Capella creates the new realm with an auto-generated name.

Users need to know the realm name to sign in with SSO.

Ping Field		Capella Field
Contents of Download Signing Certificate X509 PEM (.crt)		SAML Signing Certificate
Single Signon Service		Sign-in Endpoint URL

Field	Value
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
SAML Protocol Binding	HTTP-POST

Complete the Ping Configuration

Now that you have created the realm, you need to configure Ping to replace the placeholder values you used.

In the Ping admin console, open the application you created for Capella.
With the Overview tab open, click the Protocol button with the gear icon.

Edit the configuration settings:

Copy the following fields from your Capella realm configuration to the Ping configuration:

To find this information for your organization’s Capella realm, open the SSO page. Listed on this page is the realm you just created with an auto-generated name. Click its listing to open the realm information page.

Capella Field		Ping Field
Callback URL		ACS URLs
Entity ID		Entity ID

Capella Field

Ping Field

Callback URL

ACS URLs

Entity ID

Click Save.
Assign users to the application.
1. With the application details open, click the Access tab.
2. Add the groups whose members need access to Couchbase Capella. See the Application access control page of the Ping documentation for more detail.

Prerequisites

To configure CyberArk as an IdP, you need:

SSO enabled for your Capella organization.
A CyberArk account.
To sign in to the CyberArk Admin Portal as an admin.

Procedures

To configure federated and SSO authentication using CyberArk as your identity provider (IdP), you must complete three procedures in the following order:

In CyberArk, create an Application
In Capella, create a realm
In CyberArk, complete the configuration

Add a CyberArk Web App

Start by creating a CyberArk web application in the Cyberark Admin Portal. You need the information from this step to create a realm in Capella.

In the CyberArk Admin Portal, click Apps & Widgets Web Apps.
Create the web application:
1. Click Add Web Apps.
2. Click the Custom tab.
3. In the list of templates, find the SAML option and click Add.
4. To add this application, click Yes.
5. Exit the Add Web Apps dialog by clicking Close.
  
  You now see the Settings page for the SAML app.
6. Fill in the following fields:
  - Name: Add a unique application name.
  - (Optional) Description: Add a description of the application.
  - (Optional) Logo: Add the Capella logo.
7. Click Save.
Start the SAML configuration:
1. Click SAML Response:
2. Use the Add button to add the following attributes:
  
  After adding an attribute, you can show the Add button again by clearing the check box.
  
  Attributes Name Attribute Value
  
  email
  
  LoginUser.Email
  
  given_name
  
  LoginUser.FirstName
  
  family_name
  
  LoginUser.LastName
  
  groups
  
  LoginUser.RoleNames
3. Click Save.
Assign your admin account with permissions to the app:
1. Click Permissions.
2. Click Add.
3. In the search field, enter your admin account.
4. From the list of results, select your name and click Add.
5. On the Permissions screen, grant your account the following permissions:
  - Grant
  - View
  - Manage
  - Delete
  - Run
  - Automatically Deploy
6. Click Save.
  
  The status of your web app now shows Deployed.
Click the Trust tab.

You need information from this page to create a realm in Capella.

Attributes Name	Attribute Value
`email`	`LoginUser.Email`
`given_name`	`LoginUser.FirstName`
`family_name`	`LoginUser.LastName`
`groups`	`LoginUser.RoleNames`

Create a realm in Capella

With a CyberArk web application created, you need to create a realm in Capella using information from CyberArk.

In Capella, open the SSO page:
1. In the Capella UI, click the Settings tab.
2. In the navigation menu, click SSO.
Click Create Realm.
Complete the Create Realm page:
1. Copy the following information from your CyberArk configuration to Capella:
  
  To find this information in the CyberArk Admin Portal, go to Apps & Widgets Web Apps. Find and open the web application that you want to view. Click Trust.
  
  CyberArk Field Capella Field
  
  Contents of Signing Certificate Download
  
  SAML Signing Certificate
  
  Single Sign On URL
  
  Sign-in Endpoint URL
2. Verify that the remaining SAML protocol settings are as follows:
  
  Field Value
  
  Signature Algorithm
  
  RSA-SHA256
  
  Digest Algorithm
  
  SHA256
  
  SAML Protocol Binding
  
  HTTP-POST
3. Choose a default team.
  
  Capella automatically assigns users to the chosen default team when they don’t match any team based on their SSO groups. All users assigned to the default team have its chosen permission set.
  
  See Manage Capella Role Mapping for information about Teams and how to configure their permissions.
4. Choose to enable or disable group mapping.
  
  Capella enables group mapping by default. Group mapping allows you to assign roles to SSO users based on which teams map to their SSO group. If you disable group mapping, Capella uses the default team to give SSO users their roles when they first sign in. After SSO users sign in, you manage them like other Capella users through the People tab and each project’s Collaborators tab.
Click Create Realm.

Capella creates the new realm with an auto-generated name.

Users need to know the realm name to sign in with SSO.

CyberArk Field		Capella Field
Contents of Signing Certificate Download		SAML Signing Certificate
Single Sign On URL		Sign-in Endpoint URL

Field	Value
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
SAML Protocol Binding	HTTP-POST

Complete the CyberArk Configuration

Now that you have created the realm, you must finish configuring the CyberArk web application.

In the CyberArk Portal, open the application you created for Capella.
Click Trust.

At the end of the page, edit the Service Provider Configuration settings:

Select Manual Configuration.

Copy the following fields from your Capella realm configuration to the CyberArk configuration:

To find this information for your organization’s Capella realm, open the SSO page. On this page is the realm you just created with an auto-generated name. Click its listing to open the realm information page.

Capella Field		CyberArk Field
Callback URL		Assertion Consumer Service (ACS) URL
Entity ID		SP Entity ID / Issuer / Audience

Capella Field

CyberArk Field

Callback URL

Assertion Consumer Service (ACS) URL

Entity ID

SP Entity ID / Issuer / Audience

Click Save.
Assign users to the application.
1. Click Permissions.
2. Add the groups whose members need access to Couchbase Capella. See the {cyberark-deploy-ref}[Deploy applications] page of the CyberArk documentation for more detail.

Prerequisites

To configure Google Workspace as an IdP, you need:

SSO enabled for your Capella organization.
To sign in to the Google Admin console as a super administrator.

Procedures

To configure federated and SSO authentication using Google as your identity provider (IdP), you must complete three procedures in the following order:

In Google Workspace, create a custom SAML app.
In Capella, create a realm.
In Google Workspace, complete the configuration.

Add a custom SAML app in Google Workspace

Start by adding an app for Capella in the Google Admin console. You need information resulting from this step to create a realm in Capella.

In the Google Admin console, click Apps Web and mobile apps.
Click Add app Add custom SAML app.
Complete these fields:
- App Name: Enter the display name for this app.
- (Optional) Description: Add a description of the application.
- (Optional) App Icon: Add the Capella logo.
  1. Click Continue.
    
    Leave this new page open as you need its information for the next step.

Create a realm in Capella

Create a realm in Capella using information from Google.

In Capella, go to meu:Settings[SSO].
Click Create Realm.
Complete the Create Realm page:
1. Copy the following configuration details from Google into Capella:
  
  Google Field Capella Field
  
  Certificate
  
  SAML Signing Certificate
  
  SSO URL
  
  Sign-in Endpoint URL
2. Verify that the remaining SAML protocol settings are as follows:
  
  Field Value
  
  Signature Algorithm
  
  RSA-SHA256
  
  Digest Algorithm
  
  SHA256
  
  SAML Protocol Binding
  
  HTTP-POST
3. Choose a default team.
  
  Capella automatically assigns users to the chosen default team when they don’t match any team based on their SSO groups. All users assigned to the default team have its chosen permission set.
  
  See Manage Capella Role Mapping for information about Teams and how to configure their permissions.
4. Choose to enable or disable group mapping.
  
  Capella enables group mapping by default. Group mapping allows you to assign roles to SSO users based on which teams map to their SSO group. If you disable group mapping, Capella uses the default team to give SSO users their roles when they first sign in. After SSO users sign in, you manage them like other Capella users through the People tab and each project’s Collaborators tab.
Click Create Realm.

Capella creates the new realm with an auto-generated name.

Users need to know the realm name to sign in with SSO.

Google Field		Capella Field
Certificate		SAML Signing Certificate
SSO URL		Sign-in Endpoint URL

Field	Value
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
SAML Protocol Binding	HTTP-POST

Complete the configuration in Google Workspace

Now that you have created the realm, you must finish configuring the custom SAML app in Google.

Returning to the Google Admin console, on the Add custom SAML app setup page, click Continue.

Copy and paste the following fields from your Capella realm configuration into the Google custom SAML app setup:

Capella Field		Google Field
Callback URL		ACS URL
Entity ID		Entity ID

Capella Field

Google Field

Callback URL

ACS URL

Entity ID

In the Google Admin console, click Continue.
Add the following attributes:

Google Directory attributes App attributes

Primary email

email

First name

given_name

Last name

family_name
Add group membership.

Google groups App attribute

Relevant Google groups, such as admins.

Groups
Click Finish.

A page for the new custom SAML web app automatically loads with its configuration details.
Turn on the SAML web app for everyone:

To turn on the service for an organizational unit or user group, see Google Workspace Admin Help.
1. Click User access.
2. Click On for everyone.
3. Click Save.
  
  It may take a few minutes for these changes to apply.

Google Directory attributes	App attributes
Primary email	`email`
First name	`given_name`
Last name	`family_name`

Google groups	App attribute
Relevant Google groups, such as admins.	`Groups`

Prerequisites

To configure OneLogin as an IdP, you need:

SSO enabled for your Capella organization.
A OneLogin account.
To sign in to the OneLogin Admin panel as an Account Owner.

Procedures

To configure federated and SSO authentication using OneLogin as your identity provider (IdP), you must complete three procedures in the following order:

In OneLogin, create an Application.
In Capella, create a realm.
In OneLogin, complete the configuration.

Add an Application in OneLogin

Start by adding an application for Capella in the OneLogin Admin panel. You need information from this step to create a realm in Capella.

In the OneLogin Admin panel, click Applications Applications.
Create the application:
1. Click Add App.
2. In the search field, type SAML and press Enter.
3. From the templates list, find and click SAML Test Connector (IdP).
4. Complete the following fields:
  - Display Name: Enter the display name for this app.
  - (Optional) Rectangular Icon / Square Icon: Add the Capella logo.
  - (Optional) Description: Add a description of the application.
5. Click Save.
In the navigation pane, click SSO.
In the X.509 Certificate section, click View Details.
Select SHA256 as the SHA fingerprint.
Copy the X.509 Certificate.
Click Save.

Create a realm in Capella

With the application created in OneLogin, you need to create a realm in Capella using information from OneLogin.

In Capella, go to Settings SSO.
Click Create Realm.
Complete the Create Realm page:
1. Copy the following information from your OneLogin configuration to Capella:
  
  All this information is in the SSO section of the OneLogin Admin panel when configuring your application.
  
  OneLogin Field Capella Field
  
  X.509 Certificate
  
  SAML Signing Certificate
  
  SAML 2.0 Endpoint (HTTP)
  
  Sign-in Endpoint URL
2. Verify that the remaining SAML protocol settings are as follows:
  
  Field Value
  
  Signature Algorithm
  
  RSA-SHA256
  
  Digest Algorithm
  
  SHA256
  
  SAML Protocol Binding
  
  HTTP-POST
3. Choose a default team.
  
  Capella automatically assigns users to the chosen default team when they don’t match any team based on their SSO groups. All users assigned to the default team have its chosen permission set.
  
  See Manage Capella Role Mapping for information about Teams and how to configure their permissions.
4. Choose to enable or disable group mapping.
  
  Capella enables group mapping by default. Group mapping allows you to assign roles to SSO users based on which teams map to their SSO group. If you disable group mapping, Capella uses the default team to give SSO users their roles when they first sign in. After SSO users sign in, you manage them like other Capella users through the People tab and each project’s Collaborators tab.
Click Create Realm.

Capella creates the new realm with an auto-generated name.

Users need to know the realm name to sign in with SSO.

OneLogin Field		Capella Field
X.509 Certificate		SAML Signing Certificate
SAML 2.0 Endpoint (HTTP)		Sign-in Endpoint URL

Field	Value
Signature Algorithm	RSA-SHA256
Digest Algorithm	SHA256
SAML Protocol Binding	HTTP-POST

Complete the OneLogin Configuration

Now that you have created the realm, you must finish configuring the OneLogin application.

In OneLogin, click Configuration.

Copy the following fields from your Capella realm configuration to the OneLogin configuration:

Capella Field		OneLogin Fields
Callback URL		ACS (Consumer) URL Validator ACS (Consumer) URL
Entity ID		Audience

Capella Field

OneLogin Fields

Callback URL

ACS (Consumer) URL Validator
ACS (Consumer) URL

Entity ID

Audience

In OneLogin, click Save.

Add the parameters:

In OneLogin, with the application open, click Parameters.

Click + to add each of the following attributes:

Field name Flags Value

Field name	Flags	Value
`given_name`	Include in SAML assertion	`First Name`
`family_name`	Include in SAML assertion	`Last Name`
`email`	Include in SAML assertion	`Email`
`groups`	Include in SAML assertion	`User Roles`

given_name

Include in SAML assertion

First Name

family_name

Include in SAML assertion

Last Name

email

Include in SAML assertion

Email

groups

Include in SAML assertion

User Roles

Click Save.
Assign users to the application or add the application to a role.

For more information, see the Roles and App Management pages of the OneLogin documentation.

Add Federated and SSO Authentication

Access and Enable SSO Settings

Configure Federated and SSO Authentication

Next Steps