A custom SAML SaaS lets employees sign in to a SaaS through Factorial IT when that SaaS supports SAML single sign-on (SSO) but is not in the SaaS catalogue. You swap SAML details between the Factorial IT console and the admin console of the SaaS.
Feature/Functionality
Overview
You choose who acts as the identity provider: Factorial IT, Google or Entra. Factorial IT gives you its identity provider details to paste into the SaaS. The SaaS gives you its service provider details to paste back.
How to use
- Go to SaaS > Directory and click Add a SaaS.
- Choose Custom SAML. In Connect a new SaaS, type the name of the SaaS, add its logo and confirm. The SaaS opens on its Settings tab, with the Enable Single Sign-On (SSO) window already open.
- Pick the sign-in method: Login with Factorial IT, Login with Google or Login with Entra.
- Paste the identity provider details into the SAML settings of the SaaS. Take only the ones it asks for:
| Detail | Button |
|---|---|
| Identity provider ID (entity ID) | Copy identity provider ID |
| Metadata | Copy metadata URL or Copy metadata, or download the file |
| Login URL (SSO URL) | Copy login URL |
| Signing certificate | Copy certificate or download it. Use the SHA-256 copy if the SaaS asks for a fingerprint |
- Take these two values from the SAML settings of the SaaS and enter them in the window:
- Service provider entity ID
- Assertion consumer service URL (ACS URL)
- Click Connect.
Tips and Best Practices
- Test with one employee before you enforce SSO. Do it before the SaaS makes SSO mandatory, so nobody is locked out.
- Check the catalogue first. A catalogue connection can do more than sign-in, such as creating accounts.
- Use the SHA-256 copy when asked for a fingerprint. Some SaaS want the fingerprint, not the full certificate.
- Give the SaaS a clear name and logo. Employees and admins will see it in the Directory.
Troubleshooting and FAQ
Troubleshooting
- Sign-in fails after you click Connect. Compare the service provider entity ID and ACS URL in Factorial IT with the values in the SaaS. A single wrong character breaks the link.
- The SaaS rejects the certificate. It may expect a fingerprint. Use the SHA-256 copy instead.
FAQ
-
When should I use a custom SAML SaaS instead of the catalogue?
Only when the SaaS supports SAML SSO and is not in the catalogue.
-
Which identity provider should I pick?
Factorial IT, Google or Entra all work. Choose the one your employees already use to sign in.
-
What if the SaaS does not support SAML at all?
Track it manually instead.