How to set up your Identity Provider (IdP) SSO for Chili Piper

In this article, we will walk through the required steps to integrate your Identity Provider (IdP) SSO with Chili Piper.

Table of Contents

• Things to Know
• How to configure SAML SSO for your Identity Provider
• SAML Features
• SAML Attributes include

Things to Know

• You must be a Chili Piper admin to enable Single Sign-On (SSO).
• You must use the same email address for both Chili Piper and your IdP.

Chili Piper supports any enterprise identity provider (IdP) using the SAML 2.0 protocol. We have tested and documented SAML SSO setup instructions for the following identity providers: Okta

Since steps may vary by identity provider, consult your provider's documentation for more information.

Recommended: Send a Stable, Immutable NameID

In a SAML 2.0 assertion, the Subject contains a NameID, and its type is set by the NameID Format. When your identity provider supports it, use the persistent format, which returns the same stable value for a user across sessions instead of their email address.

NameID Format URIs (note the version prefix differs by format):

• Persistent: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
• Transient: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
• Email address: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
• Unspecified: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

Since the exact configuration screen and field names vary by identity provider, consult your identity provider's documentation for setting the NameID Format and the attribute that populates the NameID value.

How to configure SAML SSO for your Identity Provider

1. In the Command Center, access SAML Configuration by clicking Integrations in the left-side menu and clicking the Single Sign-On tab. Then click Connect on the Single Sign-On card. 
   
   
    
2. Copy and Paste the Single Sign-On and the SP Entity ID from Chili Piper into your Identity Provider. These URLS cannot be edited in any way, or they will not work.
   
        Your Identity Provider may refer to the Single Sign-On field as
   • Default ACS
   • Reply URL
   • Application Callback URL
   • SAML Consumer URL
     
     Your Identity provider may refer to the Entity ID field as:

• Audience URL
• Identifier
  
  Some Identity Providers require Recipient/Destination:
• A field called “recipient” or "destination"
• A checkbox to enable sending the ACS as the recipient & destination
• No field or checkbox - the IdP will automatically send the ACS URL as the recipient and destination
   

1. Copy the metadata URL from your Identity Provider, and paste to Metadata URL field in Chili Piper in Step 2 section of the IdP setup:
   
   If your identity provider has application restrictions for users, update those rules so you and the appropriate users can use Chili Piper.
   
   In Chili Piper, click Test Connection and you will be directed to your IdP login screen. You must log into your IdP using the same credentials that you are logged into Chili Piper.
   
   If the Connection is successful, you will be redirected back to Chili Piper to enforce SSO for all users.
   
    

2. If you want to enforce your users only logging in via your IdP, you can opt to do this now. This option will only be available if testing the connection in Step 2 was successful.

   

SAML Features

• SP login flow (Service-provider Initiated)
   
• User can log in via fire.chiliipiper.com, and your Identity provider will authenticate the user
   
• Identity Provider Initiated SSO (IdP-initiated)
  • Users can log in to their identity provider and select the Chili Piper app.
  • Only available if your identity provider supports a Default Relay State.

• JIT provisioning is not supported.

SAML Attributes include:

• firstName: user.firstName
• lastName: user.lastName
• email: user.email

Reference file: how-to-set-up-your-identity-provider-idp-sso-for-chili-piper.md (https://help.chilipiper.com/hc/article_attachments/53436231538963)