Single Sign On (SSO)

Single Sign-On | Premium Feature on the ULTIMATE Plan
Location: Administration in the left-side navigation
Supported Providers: OneLogin, Okta, Azure

Open

LiquidPlanner supports SAML 2.0 (Security Assertion Markup Language), which allows the use of SSO through enterprise identity providers such as Active Directory and LDAP. Single Sign-on is available for Organizations on the Ultimate Plan.

Org Admins configure SSO under Administration in the left side navigation. Enabling Single Sign-on via SAML 2.0 means that user authentication is handled entirely outside of LiquidPlanner.

The following providers are supported: OneLogin, Okta, Azure. Instructions for each provider are at the bottom of this lesson.

After SSO is enabled, users may log in from the SSO login page or the “Sign in with Single Sign-On” link on the LiquidPlanner sign-in page.

When new members are invited to LiquidPlanner they’ll be directed to your Organization’s SSO provider login page to enter their SSO credentials during the account activation process.

In order to enable SSO, your LiquidPlanner Organization needs to be on the Ultimate Plan. SSO can also be tested during an Ultimate trial or Premium Features trial. Prior to enabling, work with your IT team to ensure the following:

Your SSO Identity Provider is SAML 2.0 based, set up and fully configured.
You know your ‘SAML 2.0 URL’. Also known as the Remote Login URL for your SAML server/service. Sometimes this is referred to as SAML Single Sign-on URL.
You know your Issuer URL.
You have the SSL certificate.

Open

Single Sign- on is found under Administration in the left-side navigation. Organization Administrators are the only people who can access the SSO set-up and management pages. The following providers are supported: OneLogin, Okta, Azure. Instructions for each provider are at the bottom of this lesson.

On the Setup SSO tab, fill out the attributes with information provided by your SSO Provider:

1. Issuer URL

2. Sign-on URL

3. Logout Landing URL (Optional)

4. SSO Identity Provider Certificate (Copy the entire text from the certificate and paste it here)

Each of the input fields have placeholder text to guide you. Hover over the question marks for additional help. Save to commit your changes after filling in the required fields.

The green check mark in the Step 1 header confirms that the information is saved in your LiquidPlanner Org.

Service Provider Details

Use the information from the Service Provider Details table to configure LiquidPlanner as a service provider in your SSO Provider settings.

Configuring SSO or making any changes to the configuration needs to be tested before moving to the final step. Scroll down to Step 2 on the Setup SSO tab and use the Test Login button to test your SAML login.

Testing directs you to the SSO Provider login page on a new tab. Contact your SSO IT administrator if you don’t know the credentials.

If your test was successful, you’ll be returned to the SSO Setup page in LiquidPlanner. A green check mark in the Step 2 header confirms your success and the test button becomes disabled at this point. Now you’re ready for the final step: Enable and Manage SSO.

If testing was unsuccessful, go back to Step 1 and review the configuration fields.

After configuration and testing use the Final Step button at the bottom of SSO Setup to activate the Manage SSO view. This is where an Org Admin can enable or disable SSO for their Organization, set SSO user requirements and defaults.

Enable SSO for your Organization

Select Yes to enable SSO for the organization.
Select No to disable SSO for the organization. All users will use their email and a password to login.

Selecting Yes enables the next two sections:

Require ALL Users to use SSO?

Selecting Yes requires all users to use SSO, while No allows for mixed authentication. With mixed authentication, users can be opted out of SSO manually by clicking on the Manage User Exception button.

Manage User Exceptions

In the Manage User Exceptions window, click on the red arrow button against a user’s name to move them to the SSO Enabled list. Click on the gray arrow button to move the user to the SSO Disabled list. The Manage User Exception modal is disabled if “Require ALL Users to use SSO is set to Yes”.

Save commits your selections and closes the window.

New User Default

This section controls what happens when new users are invited to a LiquidPlanner workspace. Organizations requiring everyone to use SSO will have the SSO option enabled by default. Those with mixed access can elect to have new users invited with or without the SSO requirement.

Choose “LP” if you prefer to have new users log in with their own email and password during the invitation process. The SSO requirement can be set manually after they have accepted their invitation. Click on Manage User Exceptions to access the member list.

Save

Save to commit your changes. Anyone who has been added to SSO Enabled list for the first time will be prompted to authenticate via SSO at their next action with LiquidPlanner.

Log into your OneLogin account and go to the Applications tab. Click on the button to “Add App” and enter “SAML” into the search bar.

Select “SAML Custom Connector (Advanced) SAML 2.0”

Configuration

On this screen, enter Display name = LiquidPlanner, Visible portal = enabled and then Save.

Click on Configuration in the left-side navigation and enter the following attributes from the SSO Setup page in LiquidPlanner:

In OneLogin, go to “SSO” and copy these attributes, then paste them into the LiquidPlanner SSO Setup page:

Save settings in OneLogin and in LiquidPlanner.

Log into your Okta account and select Applications in the left-side navigation. Use the Create App Integration button to get started.

Create a New App Integration

Select SAML 2.0 as the Sign-in method and click Next

Create SAML Integration in three steps

In step one under General Settings, enter LiquidPlanner as the app name.

Configure SAML

Go to the Configure SAML tab and enter the following attributes from the SSO Setup page in LiquidPlanner:

Additional Okta Settings

Default relaystate = <blank>
Name ID format = Email address
Application username = Email
Update application username on = create and update

After updating these fields click Next to open the Feedback tab.

Feedback

On the Feedback tab, select “I’m an Okta customer adding an internal app.” and leave everything else blank.

Click Finish and return to the General Settings tab. Select Go to Sign-On and then View Setup Instructions. Copy these attributes, then paste them into the LiquidPlanner SSO Setup page:

Save settings in Okta and LiquidPlanner. At this point Okta has additional settings under “Assignment” that need to be enabled which are not related to LiquidPlanner. Work with your IT team to follow through with remaining settings.

Log into your Azure account to open the Azure Portal. Click on All Services to access the Azure Active Directory Default Directory Overview. Choose Enterprise Applications in the left-side navigation under Manage on the Overview page.

In the Azure AD Gallery select All Applications and New Application. Enter SAML Toolkit in the search box and select Azure AD SAML Toolkit from the results.

Azure AD SAML Toolkit

Enter a name into the tool kit to identify LiquidPlanner as an available app.

Click Create at the bottom of this page and wait a few moments while the app is added to your tenant.

Configure SSO for LiquidPlanner

Choose Single sign-on in the left-side navigation under Manage and begin the Basic SAML Configuration by entering the following attributes from the SSO Setup page in LiquidPlanner:

Update Attributes & Claims

Under Required Claim, specify user email as the value. Enter values for Additional claims as needed.

Base64 Certificate File

Download the Base64 Certificate File.

Copy these attributes, then paste them into the LiquidPlanner SSO Setup page:

Save settings in Azure and LiquidPlanner.