SSO with other SAML Providers

Introduction

Don’t you hate remembering all of your passwords? With OpsLevel’s Single Sign-On integration all of your microservice data is seconds away without the need for another long and secure password.

With single sign-on, you get:

1. Automatic user provisioning: OpsLevel will create a user for you as long as the employee has access to the OpsLevel application in your identity provider.
2. Revoke user access: Removing a user’s access from OpsLevel is as simple as revoking their access in your identity provider.

Using Google, Auth0 or Okta?

Checkout our guides on how to configure Google, Auth0 or Okta alongside OpsLevel!

Setting up Single Sign-On with SAML

The following metadata URL can be used to help automate the configuration of SAML within your identity provider. Note: You will need your provider_key, located in your Account Settings under Authentication Method

https://app.opslevel.com/users/auth/saml/metadata?provider_key={provider_key}

Required Identity Provider Attributes

1. Destination: Sometimes labeled as Recipient URL or Single Sign-On URL. This will be the URL OpsLevel will receive the SAML response to. This value is located in your Account Settings under Authentication Method:

https://app.opslevel.com/users/auth/saml/callback?provider_key={provider_key}

2. Audience: Sometimes labeled as Audience Restriction or SAML Audience. This field should be configured to:

opslevel

3. Email: The user’s email address. This is expected as an attribute with a name value of email

📘

Ensure that you use SHA1 token encryption

Note: OpsLevel supports SHA1 token encryption for SAML tokens. Configure your SAML provider to use SHA1 token encryption during your SSO/SAML setup.

Auto-Provisioning Attributes

In order to have users auto-provisioned when they first sign in, we require the following optional attributes:

1. first_name: The given name of the user.
2. last_name: The family name of the user.

OpsLevel Configuration

Any admin user on your OpsLevel account may configure the SAML single sign-on settings by:

1. Navigating to the Authentication Method section of the Account Settings page.
2. Selecting Edit at the bottom of the card.

3. Clicking on the option labeled SAML
4. Specifying the corporate email domain used by your company under: Email Domain

5. Pasting in the X.509 Certificate from the SAML configuration in your identity provider.

6. Pasting in the Single Sign-on URL from the SAML configuration in your identity provider.

7. (Optional) De-selecting Allow authentication via email / password once your configuration has been verified as operational.

Log in via Single Sign-on

1. Navigate to the OpsLevel Sign In Page.
2. Select Log in with SSO

3. Enter the email address associated with your company.
4. Click Log in with SSO

5. If prompted, sign into your identity provider to complete the authentication request.

If you are having trouble setting up your single sign-on in any way, send us an email at [email protected] and we’ll be happy to help debug and diagnose any issues.