SSO/SAML enables members of an identity provider (IdP) of your choice to access Resource Guru without having to set up a separate Resource Guru ID (login). Resource Guru's SSO works with any IdP that supports SAML 2.0 including Google G Suite, Microsoft Azure, Okta, Ping Identity, Ping Federate, OneLogin, Bitium, LastPass, Centrify, Clearlogin, Auth0 and many others. Setting up SSO can be a bit tricky so we’ve provided a guide below using Google G Suite as the IdP.
Configuring SSO using Google G Suite as an example
Click on the plus sign in the bottom right corner to add an app.
Click Setup My Own Custom App.
Download the Certificate and make a note of the SSO URL and Entity ID - we'll use these later. Now click Next.
Add “Resource Guru” as the Application Name, then enter an option description and upload the Resource Guru logo if you want to (this will appear for users in their Google menu). Then click Next.
Leave this page open and login to Resource Guru in a separate tab.
Head on over to your Settings in Resource Guru, and click SSO followed by Configure SSO.
Copy your ACS URL and Entity ID from Resource Guru into G Suite.
Make sure the Name ID is set to "Basic Information" and "Primary Email". Change the Name ID Format to "EMAIL", then click Next.
The next step in Google allows you to add mapping - this is optional and not required. If you don’t wish to map attributes just click Finish. If you do wish to map attributes, click Add New Mapping.
Enter “first_name” into the Application attribute field, then choose Basic Information and First Name from the following drop down boxes.
Enter “last_name” into the Application attribute field, then choose Basic Information and Last Name from the following drop down boxes.
Then, in G Suite > Apps > SAML Apps, turn the service ON for everyone.
Head back over to Resource Guru and paste the SSO URL and Entity ID from G Suite into the relevant fields.
Enter the email domain for your organisation (eg @mycompany.com) and upload the certificate you downloaded from G Suite earlier.
If you would like anyone with a company email address (eg @mycompany.com) to be able to automatically set up a Resource Guru account then choose Self-service. Alternatively, if you only want people to be able to set up accounts if they have been invited into the account then choose Users must be invited.
If you want to prevent people from accessing your account after they have been removed from your IdP, choose SSO only. This setting provides centralised access control to your account via your IdP. Please note that account owners will still be able to log in using their Resource Guru ID (email & password) - this prevents everyone being locked out if the connection with your IdP fails for any reason.
Finally, click Add Configuration.
Users from your company will now be able to log into Resource Guru with their email address by using the link above on the login page.
If SSO only is switched on, only the account owner will be able to access the API. This is because users can’t use their Resource Guru ID to log in when SSO only is enabled and we can’t use SSO to determine whether API access should be granted or not.