Cloud · Single sign-on · 05
Set up single sign-on with another SAML provider
Connect JumpCloud, OneLogin, PingFederate, ADFS or any SAML 2.0 provider to Zym Labs.
This guide connects any SAML 2.0 identity provider, such as JumpCloud, OneLogin, PingFederate or ADFS, to your organization. You'll register Zym Labs as a SAML app in your provider, often called a service provider. Then you give Cloud your provider's metadata, test a sign-in and turn the connection on. For Microsoft Entra ID, Okta or Google Workspace, use their own guides: Cloud fills in more for you.
You need to be an organization owner or admin in Cloud; an owner turns the connection on.
Before you start
- A verified domain in your organization. See Verify a domain.
- Your own account at your identity provider on that domain, to test with.
- How single sign-on works, if you haven't read it: it explains what turning the connection on changes for your team.
Steps
Start the connection in Cloud
In your organization, open Single sign-on and choose Set up SSO (or New connection). Choose Other SAML provider, and under Domain this connection signs in, choose your domain.
Register Zym Labs in your provider
Create a new SAML 2.0 application named Zym Labs. Give it the values Cloud shows, the Identifier (Entity ID), https://idp.zymlabs.cloud/realms/zymlabs-cloud, and the Reply URL, or upload Zym Labs' metadata with Download SP metadata.
Send the person's email as the NameID, and the attributes email, firstName and lastName.
Give Cloud your provider's metadata
In Cloud, choose I've done this. Paste your provider's SAML Metadata URL, or upload its metadata file on the Upload XML tab. A URL is better: Cloud picks up your provider's new certificate when it rotates, where a file has to be uploaded again. The URL must be public and use HTTPS.
Check the attributes
Cloud fills in the attribute names for Email, First name and Last name. Change them only if your directory sends something different, then continue.
Test a sign-in
Choose Start test sign-in and sign in with your own work account in the window Cloud opens. When it works, Cloud shows Passed and what your provider sent for each attribute. To test with someone else's account, see Test a connection.
Turn it on
An owner chooses Activate connection. If you're an admin, choose Save as draft, and an owner can activate it later from Single sign-on. Passwords keep working until you require single sign-on.
What's next
- Require single sign-on: send everyone on your domain to your provider.
- Troubleshoot single sign-on: when a test or a sign-in fails.