Set up SAML 2.0 SSO

SAML 2.0 connects Cesura to identity providers you federate over SAML. In this setup Cesura is the Service Provider (SP) and your IdP is the identity source. This guide is for Organization Admins. If you haven't yet, read "Single Sign-On (SSO) for your organization" first.

Tip: If you don't see a Single Sign-On page, SSO isn't turned on for your organization yet. Switch on Enable Single Sign-On (SSO) in Organization Management → Preferences and save.

Important: This is a two-way exchange. You give Cesura your IdP's details, and you give your IdP the SP details (ACS URL and SP Entity ID) that Cesura generates. Cesura shows those SP details only after you save the connection — so create the connection first, then finish the IdP side.

Step 1 — Gather your IdP details

In your IdP, create a new SAML application and note these values:

IdP Entity ID — your IdP's unique identifier (issuer).
IdP SSO URL — the single sign-on endpoint Cesura will redirect to.
IdP signing certificate — the public X.509 certificate (PEM format) your IdP signs assertions with.

Step 2 — Add the connection in Cesura

Open Organization Management → Single Sign-On.
Click Add connection.
Set Protocol to SAML.

Fill in the fields:

Display name — a label for this connection (optional).
IdP Entity ID — your IdP's entity ID or issuer. Required.
IdP SSO URL — your IdP's SAML single sign-on URL. Required.
IdP signing certificate (PEM) — paste the IdP's signing certificate in PEM format. Required when creating the connection.
Email source (NameID or attribute name) — which value to use as the email. Default "NameID" (the SAML NameID); to use an attribute instead, enter the name of the attribute that carries the email.
Name attribute — the attribute that carries the user's display name. Default "displayName".

Then set the shared options — Default role for new users, Auto-create users on first login (JIT), and (optionally) Enforce SSO for this organization — and click Add connection to save.

Step 3 — Give your IdP the SP details

Open the saved connection again (the Edit connection pencil in its row). Cesura now shows the Service Provider details to copy back into your IdP:

ACS URL (give this to your IdP) — paste this into your IdP as the ACS or Reply URL (Assertion Consumer Service).
SP Entity ID (give this to your IdP) — your IdP's expected audience or SP identifier.
Download SP metadata — if your IdP supports metadata import, download this file and upload it instead of entering the two values by hand.

Step 4 — Test the sign-in

Sign out (or use a private window) and sign in to Cesura through your IdP. The first sign-in creates the Cesura user (when JIT is on) with the default role you chose. If sign-in fails, confirm the IdP Entity ID, SSO URL and certificate are correct, and that the ACS URL and SP Entity ID were saved on the IdP side exactly as shown.

Need a hand? Reach out through Contact support under Get help in the sidebar.