Skip to main content

How to: Set up Single Sign-On (Federation)

Updated

This guide explains how to set up Single Sign-On (SSO) on the Karat platform using the SAML 2.0-compliant identity provider (IdP) Federation. Follow the steps below to configure your IdP, enable SSO in Karat, and manage user provisioning and permissions.

Prerequisites

Before configuring SSO for your organization, ensure the following prerequisites are met:

  • You have an admin user account on the Karat platform.
  • You have access to a SAML 2.0-compliant identity provider IdP available with Karat.

User provisioning and permissions

The Karat platform supports Just-In-Time (JIT) provisioning of users from the IdP. When a new user authenticates with SAML for the first time, an account is automatically created for them. By default, they are assigned the 'Team Member' user type with the standard role access permissions for their group. See How To: Manage Karat Users (RBAC) to learn about user types and role access permissions.

If the user already has an account in Karat, their existing permissions remain unchanged when logging in via SSO.

If a client wants to set a new team member's user type or role access permissions, they can either wait until the new team member has logged in with SSO and their user has been JIT provisioned, or they can create a user account with the desired permissions manually in Karat before adding the user in their IdP.

Warning: Karat does not support Single Logout (SLO) or user deprovisioning via the IdP. Users signed out of the IdP will remain logged into Karat until their session has been idle for 8 hours. If a user is removed from the IdP, they will be unable to log in to Karat if the organization's SAML policy is set to "Required". To fully disable a user, see How To: Manage Karat Users (RBAC) guide.

Karat includes a setting for its 'Organization' called "SAML New User Type." This determines the default user type assigned to new accounts created via SSO. By default, the setting is configured to "Team Member," but it can be adjusted to "Admin," "Limited Team Member," or "External Team Member" based on your preferences.

We recommend utilizing this setting to ensure newly created users do not automatically gain access to sensitive areas of the Karat platform, providing an additional layer of control and security. To modify this setting, contact the Karat support team.

Karat doesn't support System for Cross-domain Identity Management (SCIM).

Note:  If your organization has enabled Single Sign-On (SSO) on the Karat platform using SAML 2.0-compliant identity providers (IdPs), avoid setting up Two-Factor Authentication (2FA). Users authenticated through SSO will not require 2FA.

Setting up SSO

To set up SSO, configure your identity provider (IdP) using the details below. Terminology may vary across IdPs—refer to IdP-specific instructions in this guide for additional help.

Enter the following configuration details into your IdP:

  • ACS URL (replace client-name with your subdomain): https://client-name.karat.io/users/auth/saml/callback
  • Entity ID: Karat
  • Metadata document (replace client-name with your subdomain): https://client-name.karat.io/users/auth/saml/metadata
  • The email attribute is required. 
  • Additionally, you must provide either full_name or both first_name and last_name. If full_name is provided, it will take precedence. Some IdPs only support first_name and last_name.
  • Attribute mappings:

<md:RequestedAttribute FriendlyName="Email address" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Full name" Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Given name" Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Family name" Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

After the identity provider is set up, email the following details to a Karat internal user to enter into Central, Karat's platform:

  • IdP URL
  • IdP certificate in PEM format

Register IdP

The Reply URL is used by the app to redirect users to the portal after the authentication succeeds. If your portal uses a custom domain name, you might have a different URL than the one provided here. More details about creating the app registration on the Azure portal are available in Quickstart: Register an application with the Microsoft identity platform.

In this section, you create the application and configure the settings with your identity provider. 

  1. Sign in to the Azure portal.
  2. Search for and select Azure Active Directory.
  3. Under Manage, select App registrations.
  4. Select New registration.

  1. Enter a name.
  2. If necessary, select a different Supported account type. For more information, see Supported account types.
  3. Under Redirect URI, select Web (if it isn't already selected).
  4. Enter the Reply URL for your portal in the Redirect URI text box. Example: https://client-name.karat.io/users/auth/saml/callback. 

Note: If you're using the default portal URL, copy and paste the Reply URL as shown in the Create and configure WS-Federation provider settings section on the Configure identity provider screen (step 6 above). If you're using a custom domain name for the portal, enter the custom URL. Make sure to use this value when you configure the Assertion consumer service URL in your portal settings while configuring the WS-Federation provider. For example, if you enter the Reply URL in Azure portal as https://client-name.karat.io/users/auth/saml/callback, you must use it as-is for the WS-Federation configuration in portals.

Register Application

  1. Select Register.
  2. Select Expose an API.
  3. For Application ID URI, click Set.

  1. To use the auto-generated URI, click Save. You'll need to manually update the value in site settings after you configure settings using the studio.
  2. If you're using a custom domain name, enter the portal URL as the App ID URI.

  1. Click Save.
  2. Keep the Azure portal open, and switch to the WS-Federation configuration for Power Apps portals for the next steps.

Portal Configurations

In this section you enter the site settings for the portal configuration.

  1. Metadata address. To configure the metadata address, do the following:
    1. Select Overview in the Azure portal.
    2. Select Endpoints.

  1. Copy the URL for Federation metadata document.

  1. Paste the copied document URL as the Metadata address for portals.
  1. Authentication type.To configure the authentication type, do the following:
    1. Copy and paste the Metadata address configured earlier in a new browser window.
    2. Copy the value of entityID tag from the URL document.

  1. Paste the copied value of entityID as the Authentication type. Example: https://sts.windows.net/7e6ea6c7-a751-4b0d-bbb0-8cf17fe85dbb/
  1. Service provider realm: Enter the custom portal URL as the service provider realm. Example: https://portal.karat.com
  2. Click Confirm.

  1. Select Close.

Update App ID URI in site settings

If you're using the auto-generated URI for the App ID URI, you'll need to update the value in site settings.

  1. Open the Portal Management app.
  2. Navigate to Site Settings.
  3. Update the site setting Authentication/WsFederation/WSFederation_1/Wtrealm with the auto-generated APP ID URI.

Click Save

Was this article helpful?

0 out of 0 found this helpful
Return to top

Related articles