SAML SSO

Paramify supports login SSO via some SAML providers

Within Paramify you can setup SSO authentication via SAML with supported providers. See other login methods on the Login Overview.

Configure in Paramify Cloud (SaaS)

To use SAML SSO in Paramify Cloud you should create a SAML application in your identity provider and then update the SAML configuration in Paramify under your Workspace settings.

Create a SAML application in your Provider

In your auth Provider create a new SAML application for Paramify and add Paramify settings.

Then add the basic SAML configuration from Paramify (found in Workspace settings under Authentication):

• In the appropriate field (e.g., Identifier), paste the "Entity ID" from the "SAML SP Configuration" from Paramify
• In the appropriate field (e.g., Reply URL), paste the "ACS URL" from the "SAML SP Configuration" from Paramify

Update SAML configuration in Paramify

In Paramify click into Workspace settings (gear icon) then Authentication, then apply the SAML configuration parameters from your Provider.

Option 1: URL setup

• Copy the "Metadata URL" from your Provider, paste it into the "Metadata URL" field

Option 2: Manual setup (either upload IDP metadata or copy values manually)

• Copy the Login URL (or equivalent), paste it into the "SSO URL" field in Paramify
• Copy the Identifier or Entity, paste it into the "Entity ID" field in Paramify
• Copy the Certificate (Base64), paste it into the "Signing Cert" field in Paramify

That's it! Test and enjoy your Paramify authentication with SAML!

If you experience any issues or have any questions, please reach out to support@paramify.com to engage our support staff.

Configure in Self-Hosted

For self-hosted deployments, you will first need to add an SSL certificate for the Paramify service provider to your configuration as well as enable SAML authentication. Then once Paramify is up and running you can complete the same identity provider and configuration steps described above in the SaaS section.

Generate an SSL Certificate

You can generate a self-signed certificate for the Paramify service provider to use to encrypt SAML communication. For example, you can generate the files with the openssl command line like so:

openssl req -x509 -nodes -days 9999 -newkey rsa:2048 -keyout saml.key -out saml.crt

Deploy Configuration

In order to prepare for SAML SSO in a self-hosted deployment, you must enable SAML for authentication and include the SSL key and certificate generated above.

If you are using the Paramify Platform Installer then in the config GUI under "Sign-On Options" you should click the Enable SAML SSO box then upload the saml.crt and saml.key files.

With a Helm-based install you can add the configuration options to your values.yaml in the configmaps.paramify.data and secrets.paramify.data sections, similar to the following:

configmaps:
  paramify:
    data:
      AUTH_SAML_ENABLED: "true"
 
 secrets:
   paramify:
     data:
      SAML_CERT: |
        -----BEGIN CERTIFICATE-----
        <cert data>
        -----END CERTIFICATE-----
      SAML_KEY: |
        -----BEGIN PRIVATE KEY-----
        <key data>
        -----END PRIVATE KEY-----

Be sure to replace the examples with the content of your saml.crt and saml.key generated above.

Configure SAML

After your Paramify self-hosted deployment is running and you've logged in as an Admin user, you can complete the same identity provider and configuration steps described above in the Configure in Paramify Cloud (SaaS) section.