How to Setup Single Sign On (SSO) Login in the Public Cloud Environment

What are the steps to setup a single sign on login service for workspaces in the public cloud environment

Labguru supports integration with Single Sign-On (SSO) systems based on the SAML standard, allowing for seamless and secure user authentication. In order to set up the service, please contact support via the messenger or at support@biodata.com. Labguru will provide you with an XML metadata file.

How to do the setup

1. Create a new application for Labguru

2. Configure the metadata information:

   • The entityID value from the metadata file should be added to the entityID field in your SSO service setup.

   • The Reply URL is: https://{prefix}.labguru.com/sso_auth, {prefix} being the URL prefix. (For example https://my.labguru.com/sso_auth, https://eu.labguru.com/sso_auth, etc.)

3. Setup the attributes and claims exactly as in the screenshot below (example from Azure).

4. Choose 'Email' as the SAML nameID format.

5. Send us back the XML file, together with a screenshot of the attributes and claims setup.

Make sure the following claim doesn't have a Namespace:

Troubleshooting

If the following error appears after setting up SSO

It means that the user.email value has quotes around it, meaning the user.email doesn’t exist as a default value and therefore cannot be added without quotes (image 2)
To resolve this issue the following steps should be performed:
1. Create a new claim named :email (image 3)
2. In the source attribute field choose user.mail (image 3)
3. If user.mail already exists as a value of another claim (image 4) - delete the claim
4. Download the XML file again and send it to us

Setup in OKTA:

Note: The Single Sign-On URL on the General section varies depending on the account server.

In exchange, Labguru will require a metadata file (SAML metadata) with a description of the IDP (that supports SAML 2.0) that you can download after the attributes were set up as described above, the file should contain the following attributes:

• EntityId

• A valid self-signed X.509 certificate

• Single Sign-On Service Endpoint

• NameID format (from the SAML 2.0 supported options)

*in order to download the metadata file go to Sign On tab in the application ->SAML Signing Certificates -> section -> Actions

After reviewing your configuration, you will need to coordinate with Labguru to arrange a date for enabling SSO functionality on your account. Once the functionality is enabled by Labguru, all users in the organization will be able to login using the SSO service. Compatible SSO Providers Labguru is compatible with various SAML-based SSO systems, including but not limited to:

• OKTA

• Onelogin

• Azure Active Directory

If you use a different SAML SSO provider, you can still configure it by following the standard SAML setup process outlined above.