Install Pando

SAML 2.0

saml Sign in through a SAML 2.0 identity provider. Pando publishes its own metadata for the provider to import.

Setup

The Metadata URL is on the app's Sign On tab.

  1. Create a SAML app in Okta

    1. In the Admin Console, open Applications → Applications and choose Create App Integration.
    2. Choose SAML 2.0, then Next, and name the app.
    3. Set Single sign-on URL to <callback URL>.
    4. Set Audience URI (SP Entity ID) to <entity ID>.
    5. Set Name ID format to Persistent.

    Okta SAML app integrations

    Settings name_id_format

  2. Send email, name and groups

    1. Under Attribute Statements, add these:
      NameValue
      okta_user_iduser.getInternalProperty("id")
      emailuser.email
      firstNameuser.firstName
      lastNameuser.lastName
    2. Under Group Attribute Statements, add groups with the filter Matches regex .*.
    3. Choose Next, then Finish.

    Settings groups_attribute

  3. Copy the metadata URL

    1. On the Assignments tab, assign the people or groups who may sign in.
    2. On the Sign On tab, copy the Metadata URL.

    Settings idp_metadata_url

The console shows the callback URL and entity ID, and pando identity-provider add prints them.

Settings (11)
idp_metadata_urlProvider metadata URL

Where the provider publishes this application's metadata. Pando re-reads it daily, so certificate rollovers are followed.

string · For example https://example.okta.com/app/…/sso/saml/metadata

idp_metadata_xmlProvider metadata XML

Or paste the metadata instead of giving a URL.

string

name_id_formatNameID format

What Pando asks the provider to identify people by. The NameID must never change for a person.

  • (empty) Unspecified — Whatever the provider is set to send.
  • persistent Persistent — An opaque ID that never changes.
  • email Email address

one of the values above

groups_attributeGroups attribute

The attribute listing the person's groups. Empty tries groups, memberOf, member and Microsoft's groups claim.

string

subject_attributeSubject attribute

Identify people by this attribute instead of the NameID.

string

email_attributeEmail attribute

Empty tries email, mail and Microsoft's emailaddress claim.

string

name_attributeName attribute

Empty tries displayName, name, and first and last name.

string

username_attributeUsername attribute

The attribute holding the person's username in Pando. Empty tries username, uid, login and Microsoft's name claim.

string

trust_emailThe provider's email addresses are verified

Only if people cannot set their own email in the provider. Needed to link accounts by email.

bool

allow_idp_initiatedAllow sign-in from the provider's dashboardAdvanced

Off is safer: a sign-in the provider starts is not tied to the browser that presents it.

bool

session_max_lifetimeSession lengthAdvanced

How long a sign-in lasts. Without SCIM this is also how long access can outlive its removal at the provider.

string · Default 12h