SAML SSO with other configurations

Document360 supports SAML SSO with any Identity Provider (IdP) that supports the SAML 2.0 protocol, even if it is not listed explicitly in Document360's IdP options. This article walks you through configuring SSO between Document360 and a custom or unlisted Identity Provider.

What you can do with a custom IdP

Before you begin

• You have the necessary credentials and administrative access to both Document360 and your chosen Identity Provider.
• You have Owner or Admin access in your Document360 project.
• Your Identity Provider supports SAML 2.0.
• Open Document360 and your Identity Provider in two separate browser tabs. You will need to switch between them multiple times during setup.

Step 1: Create a SAML application in your Identity Provider

Add a new application in your IdP

1. Log in to your Identity Provider's admin console.
2. Locate the section where you can create or manage applications (often labelled Applications, Enterprise Applications, or similar).
3. Select the option to create a new application.
4. Configure the basic settings for the new application:
   • Application Name: Enter a name, for example "Document360 SSO".
   • Application Type: Select SAML 2.0 as the sign-in method.
5. Save your application settings.

Step 2: Configure SAML in your IdP using Document360 parameters

Get the Service Provider parameters from Document360

1. Open Document360 in a separate tab.
2. Navigate to Settings () > Users & permissions > SSO Configuration.
3. Click Create SSO.

4. Select Others as your Identity Provider (IdP) to navigate to the Configure the Service Provider (SP) page automatically.

5. The Configure the Service Provider (SP) page displays the parameters you need to configure SAML in your Identity Provider.

Enter the Document360 parameters in your IdP

In your Identity Provider's SAML configuration, enter the Document360 parameters using the mapping below.

Configure attribute mapping in your IdP

You may need to configure attribute statements in your Identity Provider. Add the following attributes.

Complete any additional configuration in your IdP

1. Provide any additional configuration details required by your Identity Provider.
2. Review your settings and save the SAML configuration.
3. Click Next in Document360 to navigate to the Configure the Identity Provider (IdP) page.

Step 3: Complete the SSO configuration in Document360

Configure the Identity Provider in Document360

1. Return to the Document360 tab displaying the Configure the Identity Provider (IdP) page.
2. The Configure an existing connection field allows you to inherit an SSO configuration that has already been created. By selecting this option, the current SSO configuration will be set as the child and no changes can be made to it.

3. Enter the corresponding values from your Identity Provider using the mapping below.

4. Download the X.509 Certificate from your Identity Provider and upload it to the SAML Certificate field in Document360.
5. Toggle the Allow IdP initiated sign in option on or off based on your project requirements.

6. Click Next to proceed to the SCIM provisioning page.

Step 4: Configure SCIM provisioning

SCIM provisioning automates user and reader lifecycle management between your Identity Provider and Document360. This is available if your IdP supports SCIM.

If you do not need SCIM provisioning, skip to Step 5: More settings.

Enable SCIM in Document360

1. Turn on the Enable SCIM provisioning toggle.
2. A confirmation dialog appears. Review the terms, select the checkbox, and click Agree.

3. A set of parameters will then be displayed — use these to enable SCIM provisioning in your IdP.

Assign default role and groups in Document360

1. Turn on Enable group sync if needed. This automatically assigns users and readers based on your IdP group mappings.
2. In the Default role field, the role is set to Contributor by default. You can change this from the dropdown if needed.
3. In the User groups and Reader groups fields, select the groups you want to add. Multiple groups can be added, and they will inherit the default role you selected earlier.
4. Click Next to navigate to the More settings page.

Step 5: More settings

Configure SSO name and login options

1. In the SSO name field, enter a name for the SSO configuration.
2. In Customize login button, enter the text for the login button displayed to users.
3. Auto assign reader group — this option is only available for existing SSO configurations. For newly created SSO configurations, this toggle will not be displayed as SCIM automatically provisions users and groups. Learn more about Auto assign reader group.
4. Enable Sign out idle SSO user if needed, and toggle based on your requirements.
5. Choose whether to invite existing user and reader accounts to SSO.

6. Click Create to complete the SSO configuration.

The SSO configuration will now be set up in Document360 using your selected Identity Provider.

Inherit from another application

When creating a new SSO configuration in Document360, you can inherit SCIM settings from an existing SSO connection. This simplifies the setup process, avoids repeating configuration steps, and helps administrators save time while ensuring consistency across integrations.

Child inherited SSO configuration

On the Configure Identity Provider (IdP) page, select the Configure an existing connection field and choose the parent SSO SCIM-enabled application you want to inherit from. Selecting this option designates the current project as the child project, inheriting all relevant properties from the parent.

Parent inherited SSO configuration

The parent application will display a list of all projects that have inherited its configuration. Any changes made to the parent application will automatically be reflected in the child application.

• If SCIM is enabled in the parent project after child projects have already inherited it, the users and groups will be automatically provisioned to all child projects in the background.
• Enabling inheritance makes it easier to manage multiple SSO configurations with SCIM enabled, as all settings are controlled from one parent application. This saves time and reduces the effort required to manage each configuration individually.

Best practices

• Verify SAML 2.0 support before starting. Confirm that your Identity Provider supports the SAML 2.0 protocol. Document360 does not support SAML 1.x or proprietary SSO protocols.
• Check attribute name casing carefully. The attribute names email and name are case sensitive. Ensure they are entered exactly as shown in the attribute mapping table.
• Download and store the X.509 certificate before completing setup. You will need to upload this file to Document360. Keep a copy in a secure location in case you need to reconfigure.
• Test with a single user first. Before rolling out SSO to all users, verify the configuration with one test account to confirm that attribute mapping, certificates, and URLs are all functioning correctly.

FAQ