SAML Identity Provider Integration

Agility supports single sign-on with any identity provider that follows the SAML 2.0 protocol. This guide is for the IT administrators setting up the connection. For an overview of Enterprise SSO, see Enterprise Single Sign-On with Agility.

To start, contact your customer success representative or support@agilitycms.com. Both sides have some setup to do, and we'll test and validate the connection with you.

What we need from you

1. The SAML sign-in URL from your identity provider, so we can send sign-in requests to it.
2. The SAML sign-out URL.
3. The signing certificate from your identity provider.
4. Whether you want users to start the sign-in from your identity provider's app portal (IdP-initiated SSO).
5. The email domains the connection should apply to.

What to configure in your identity provider

We'll give you a connection name. With a connection named FooBar123, for example:

Setting	Value
Assertion Consumer Service (ACS) URL, also called the post-back URL	https://login.agilitycms.com/login/callback?connection=FooBar123
Entity ID (Audience)	urn:auth0:agilitycms:FooBar123

The assertion must include the user's email address. Agility matches it to an existing Agility user.

After the connection works

• Make SSO the only way in. Ask us to turn off the other sign-in methods for your organization, so your identity provider's policies apply to every sign-in.
• Add your users in Agility. Each person needs an Agility user with the same email address, and a role. Roles are managed in Agility, not read from your identity provider. See User Access. Provisioning users from your identity provider's groups (SCIM) is on our roadmap: vote for it.