If you can't quite get the SAML SSO behavior you want, one or more of the Advanced options may help fix your issue.
To access these options:
- Go to Security and access > Access & SSO.
- In the Login methods card, select Set up or Manage next to SAML.
- Below the numbered steps, expand Advanced options.
- Check or uncheck the options you need, then select Save changes.
Available advanced options
- On IdP-initiated login, send readers to the RelayState landing page: Check this box if people are opening links to specific articles, authenticating, and then getting kicked back to the homepage rather than redirected to the link they originally opened. (The default behavior is to send readers to the homepage. Using this option will send readers to the RelayState specified landing page a.k.a. the page they were originally trying to access!)
- Sign all messages sent to the IdP: Your IdP verifies them with the certificate in our metadata.
- Sign our metadata
- Sign all logout requests sent to the IdP
- Require all IdP assertions to be signed
- Require all IdP messages to be signed
- Require all IdP assertions to be encrypted: The assertions will be encrypted using the RSA-SHA256 algorithm. Your IdP must encrypt them with the certificate in our metadata. To get the metadata, select View metadata or Download metadata in step 1, Give these details to your identity provider.
- Match readers on SSO ID only: The default behavior for ID matching is to log in with a matching SSO ID. If no matching SSO ID is found, we then fall back to match on Username / email. With this option selected, Username / email will be ignored and only the SSO ID match is used for logins. We recommend it if readers log in only with SAML. Leave it off if existing password readers should be linked to their SAML login by email.
Options that moved
Two settings that used to be advanced options are now in the numbered SAML steps:
- Switch to an entity ID unique to this knowledge base: This button is in step 1, Give these details to your identity provider, and only appears if your knowledge base still uses the shared SP entity ID. Use it if you're setting up multiple knowledge bases to connect to the same IdP. The switch saves right away and can't be undone. Readers won't be able to log in with SAML until you update your IdP with the new SP entity ID (or upload the new metadata).
- Also log readers out of the IdP when they log out: This checkbox is in step 5, Turn on SAML. With this option selected, when a reader logs out of the knowledge base, it will also send a logout request to the IdP. Use this option if you want to ensure someone gets logged out fully from your IdP when they log out of KnowledgeOwl. It needs an IdP logout URL in step 2.