SSO

Overview

This guide explains how to configure Single Sign-On (SSO) with our platform using SAML 2.0. SSO gives your users a secure, seamless way to sign in while you keep user management centralized in your Identity Provider (IdP).

Our platform supports multiple IdPs at the same time, so you can route different user types to different providers. For example, you might authenticate your internal marketplace administrators through one IdP and your external partners through another.

Supported features

SAML 2.0 protocol
Multiple concurrent IdPs, with role segregation by user type
Just-in-Time (JIT) user provisioning
Role-based access control

How user types map to IdPs

You can map each Identity Provider to a specific user type. This keeps access control clean and lets you manage each audience separately:

Identity Provider	User type
Okta	Marketplace Administrators
Auth0	Partner Users

Each IdP is isolated to its assigned user type, so a user can only authenticate through the provider designated for their role.

Supported Identity Providers

We provide step-by-step configuration guides for:

Auth0 (SAML)
Microsoft Entra ID (formerly Azure AD)

We also support any standard SAML 2.0–compliant Identity Provider, including:

Okta
OneLogin
Google Workspace
PingIdentity
Keycloak

Setup process

Setting up SSO is a collaboration between your team and ours. The four stages below move from your IdP configuration through to joint testing.

1. Generate your IdP configuration

Configure a SAML application in your IdP.
Collect the required SAML details:
- SAML Issuer (Entity ID)
- IdP SSO URL
- X.509 certificate
Decide which user type this IdP will manage.

2. Share your configuration

Send the following to our support team or your Account Manager:

All SAML configuration details from step 1
Your desired user type mapping
A technical contact for the integration

3. We configure the integration

Our team configures the integration on our side and provides you with:

Your Assertion Consumer Service (ACS) URL
Any additional configuration details your IdP needs

4. We test together

We coordinate a testing window with you.
Together we verify user provisioning, access levels, and that each user lands in the correct user type.

Required information

From your Identity Provider

For each IdP integration, provide:

Field	Description
SAML Issuer (Entity ID)	A unique identifier for your SAML application
IdP SSO URL	The endpoint where users are redirected to authenticate
X.509 Certificate	The public certificate used to verify SAML responses
Intended User Type	Which user type this IdP manages (Admin or Partner)

From our platform

After configuration, we provide:

Field	Description
Assertion Consumer Service (ACS) URL	The callback URL where SAML assertions are posted
Additional parameters	Any extra configuration your specific IdP requires

User attribute mapping

Ensure your IdP sends the following attributes in the SAML assertion:

Our Attribute	SAML Attribute Name	Required	Description
Email	`email`	Yes	User's email address
First Name	`givenname`	Yes	User's first name
Last Name	`surname`	Yes	User's last name
Role Access	`userrole`	No	User's role

Troubleshooting

Configuration issues

Verify your SAML details match what we configured on our side.
Check that the X.509 certificate is correctly formatted and has not expired.
Confirm the user type mapping is correct.

User access issues

Verify the user exists in the correct IdP for their intended role.
Check that attribute mapping is set up as expected.
Confirm the IdP is configured for the right user type.

Security considerations

Each IdP integration is isolated by user type.
Users can only authenticate through their designated IdP.
Role assignments are enforced at the IdP level.
We recommend regular security audits for each IdP integration.

Support

For SSO setup and issues, reach out to your Account Manager and include:

Your organization name
Your intended user type mapping
Your SAML configuration details
A technical contact