> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.
# OneLogin SAML SSO
> Learn how to set up SAML SSO in Sevalla with OneLogin.
[OneLogin](https://www.onelogin.com/) is an Identity Provider (IdP) that enables secure single sign-on (SSO), allowing your company's users to access multiple applications with one login.
With Security Assertion Markup Language (SAML) SSO, employees sign in once using their company credentials (typically email and password). The IdP, such as OneLogin, verifies their identity and grants seamless, secure access to all connected services, without requiring separate logins for each application.
Company owners or IT administrators can link their organization’s email domain (e.g., @[mycompany.com](http://mycompany.com)) to the IdP so that anyone with a company email address is automatically recognized and can securely sign in to SAML-enabled tools.
Using Sevalla SAML SSO, you can connect OneLogin to Sevalla by creating a SAML application within OneLogin, verifying your company’s email domain, and adding the required OneLogin details in Sevalla. This allows your team to log in with their existing company credentials, eliminating the need to create or manage separate Sevalla accounts.
When using SAML SSO with Sevalla, login must always be initiated from Sevalla. Logging in directly from your Identity Provider (IdP) is not supported.
IdPs only support one active session per browser. If you have multiple Google Workspace accounts and are logged into one, attempting to log into another through Sevalla will result in an error. To switch accounts, log out of Google Workspace or use your browser’s Incognito/Private mode.
## Enable SSO in Sevalla
When you set up SAML SSO, you can navigate away from the SSO setup at any stage to store your progress and return later.
In Sevalla, go to your **Company settings** > **Single sign-on**, and click **Enable**.
Read through the introduction, which explains how SSO will be set up, and click **Continue**.
The next page provides all the information you need to set up your SAML app within OneLogin.
## Set up the app integration in OneLogin
In Sevalla, the **Create SAML app** tab provides all the information you need to set up your SAML app within OneLogin. The following steps explain where to add this information.
When using SAML SSO with Sevalla, all logins must be initiated directly from Sevalla. Logging in from your Identity Provider (IdP) dashboard is not supported. For this reason, you may want to hide the Sevalla app from users’ IdP dashboards to avoid confusion.
Log in to OneLogin as a user with admin access, and within **Administration**, click **Applications** > **Applications** > **Add App**.
Search for 'saml custom connector' and select **SAML Custom Connector (Advanced)**.
In the Display Name, enter the **App name** from Sevalla. You can also download the **App icon** from Sevalla and upload this to the **Square Icon**, and add a **Description** if required. Click **Save**.
Click **Configuration** and complete as follows:
* **Audience (EntityID):** Copy and paste the **Entity ID** from Sevalla.
* **Recipient:** Copy and paste the **SSO/ACS URL** from Sevalla.
* **ACS (Consumer) URL Validator:** Copy and paste the **SSO/ACS URL** from Sevalla.
* **ACS (Consumer) URL:** Copy and paste the **SSO/ACS URL** from Sevalla.
* **Login URL:** Copy and paste the **Start URL** from Sevalla.
* **SAML initiator:** Select **Service Provider**.
* **SAML nameID format:** Select **Email**.
* **SAML issuer type:** Select **Specific**.
* **SAML signature element:** Select **Assertion**.
* **Sign SLO Response:** Select this option.
* **Sign SLO Request:** Select this option.
Leave all other fields as default and click **Save**.
Click **SSO**, and within **SAML Signature Algorithm** select **SHA-256**, and click **Save**.
## Map your OneLogin attributes
Within OneLogin, you must map the firstName, lastName, and email attributes from Sevalla to the correct fields within OneLogin. For more information about how to do this, refer to the [OneLogin documentation](https://onelogin.service-now.com/support?id=kb_article\&sys_id=c1e4255a9758ea900f94b86ef053af1a\&kb_category=566ffd6887332910695f0f66cebb3556).
## Assign users to the OneLogin app
In OneLogin, you can assign a policy to the application to allow all users using the policy to log in to the app. Go to **Applications** > **Applications**, select the application you set up for the Sevalla Dashboard, click **Access**, choose the policy you want to assign, and click **Save**. For more information about security policies, refer to [OneLogin's documentation](https://onelogin.service-now.com/support?id=kb_article\&sys_id=1510ecd787dee610f7b8a7dd3fbb35d9\&kb_category=95c6573887772910763a0ed7dabb3538).
You can also assign individual users to the application. In OneLogin, click **Users** > **Users**, select the user you want to assign, click **Applications**, and click the plus icon.
From the **Select application** dropdown, select the Sevalla application, and click **Continue**.
Select **Allow the user to sign in**, ensure the credentials are correct, and click **Save**.
To test authentication, make sure the Sevalla user account you’re signed in with is assigned.
## Sevalla setup
In Sevalla, on **Create SAML app**, click **Continue** so that you are on the **Sevalla setup** page.
### Email domain
In the **Domain name**, enter the email domain users will use to sign in using SAML SSO, and click **Add domain**.
Only Sevalla accounts with an email address matching the verified domain can authenticate via SAML. For example, if SAML is enabled for `example.com`, only users with an `@example.com` email address will be able to sign in for that company.
Each email address can only be linked to one SAML configuration in Sevalla. This means a domain (e.g., `example.com`) can be associated with only one company at a time. Similarly, each Sevalla user can use SAML authentication for a single company only.
If the domain has already been verified in Sevalla through DNS management or as a site domain, it will automatically be verified. If it hasn’t, you’ll be prompted to add a TXT record to your DNS management service to confirm domain ownership.
Because DNS changes can take time to propagate, you can navigate away from the SSO setup to store your progress and return later.
#### Set up Sevalla SAML
In OneLogin, go to **Applications** > **Applications**, select the application you set up for the Sevalla Dashboard, and click **SSO**.
This page provides all the information you need to set up SAML in Sevalla.
In Sevalla, within the Single sign-on **Sevalla setup** tab, complete the fields as follows:
* **SSO URL:** Copy and paste the **SAML 2.0 Endpoint (HTTP)** from OneLogin.
* **Entity ID:** Copy and paste the **Issuer URL** from OneLogin.
* **Public certificate:** In OneLogin, on the **X.509 Certificate**, click **View Details**, copy and paste the contents of the **X.509 Certificate**.
Certificates can expire, so you may need to update this in the future. Company Owners and Company Administrators will receive a notification three weeks prior to certificate expiration to ensure the certificate is updated in a timely manner.
Click **Continue**.
## Test the authentication in Sevalla
You cannot enable SAML SSO within Sevalla without first testing the authentication.
In Sevalla, within Single sign-on, click **Continue** until you are on the **Test and finish** tab, and click **Test authentication**.
A notification appears if the test was successful or if the test fails.
If the test fails, click **Back** and check your SAML settings within your IdP and within Sevalla.
If the test is successful and you want to enable SAML, click **Save and set SSO live**.
Your Sevalla company users will now be able to sign in with SAML SSO or by entering their username and password. Users who sign in through an IdP are not required to complete Sevalla's 2FA, as authentication is handled directly by the IdP.
If you want to force users to sign on via SAML, you can enable Mandatory SSO and add Exceptions. You can also enable JIT provisioning to allow users authorized by your IdP to access your Sevalla company without requiring an invitation.
## Change the session duration
Your Identity Provider (IdP) determines how long your SSO session remains active and when it expires. If your IdP doesn’t specify a session duration, Sevalla defaults to a 24-hour session.
When your SSO session expires, you’ll be logged out of SSO. If you’re working within a company that uses SSO, you’ll be prompted to reauthenticate. If you have access to multiple companies in Sevalla, you’ll remain logged in overall but will need to reauthenticate before accessing any company that requires SSO.
For details on adjusting session duration, refer to the [OneLogin Knowledge Base](https://support.onelogin.com/kb/4271392/user-policies).