Enabling single sign-on via SAML 2.0

Set up single sign-on (SSO) with a SAML provider to give everyone in your organization access to Robin. Robin supports IDP-initiated or SP-initiated flow through a custom configuration, with native provider support for Okta, OneLogin and Rippling.

SAML authentication is available for organizations with Advanced Authentication and Security. All other accounts can use SSO with Google and Microsoft 365.

Guides are available for these providers:

• Google Workspace
• Okta
• Delinea (formerly Centrify)
• ADFS
• Microsoft Entra ID (formerly Azure Active Directory)
• Rippling (set up through the Rippling integration)
• Custom (works with everything)

Add your identity provider to Robin

Enter your IDP's details in the SAML configuration form in the Robin web dashboard.

1. As an admin, go to Manage > Security. You can also go to Manage > Integrations and select Manage Sign-In Options.
2. In the SAML 2.0 card, select Add. The SAML configuration form opens.
3. In Provider, select Custom (Default) or a named provider.
4. Enter the SAML SSO URL, Identity Provider Issuer and Public Certificate. To fill them from a file, select Import IDP Metadata.
5. Select Save Configuration.

For more settings, select the Advanced Options link. Most IDPs do not need them.

Okta and OneLogin also have their own pages. In Manage > Integrations, select Set up (or Manage) next to Okta or OneLogin. The Single sign-on card shows Robin's values to copy into your IDP.

Configure your identity provider

Fill in a few fields in your IDP to connect it to Robin. If you are not sure which configuration to use, or a provider's connector app gives you trouble, use Custom.

Required metadata attributes

Map these attributes to the matching user fields in your IDP. Attribute names are case-sensitive. If you cannot change your attribute names, try assigning these to FriendlyName instead.

These examples show each value in a SAML response.

NameID

<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
  testuser@youremail.com
</saml:NameID>

Email

<saml:Attribute Name="Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml:AttributeValue xsi:type="xs:anyType">testuser@youremail.com</saml:AttributeValue>
</saml:Attribute>

FirstName

<saml:Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml:AttributeValue xsi:type="xs:anyType">Jane</saml:AttributeValue>
</saml:Attribute>

LastName

<saml:Attribute Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml:AttributeValue xsi:type="xs:anyType">Smith</saml:AttributeValue>
</saml:Attribute>

Custom provider

Use these values or the SP metadata file to get started. If your IDP uses different names for the metadata attributes, map them.

Auth Context under Advanced Options lists the sign-in methods Robin asks your IDP to use. Password Protected Transport is checked by default. Your IDP must sign the user in with one of the checked methods, or sign-in fails. If you uncheck every box, Robin does not ask for a method, and your IDP uses any method.

Encrypt Assertion is on by default under Advanced Options. With it on, Robin signs its sign-in requests and asks for an encrypted NameID. If your identity provider (for example ADFS) cannot handle signed requests or encrypt the NameID, uncheck Encrypt Assertion. Otherwise, sign-ins that start from Robin can fail. When it is off, Robin stops signing requests and ignores Encrypt NameID attribute, even if that box stays checked.

Copy Robin's Public Key (x509 cert):

-----BEGIN CERTIFICATE-----
MIICtjCCAh+gAwIBAgIUeTzNrcUw+kyMMormmeinC5f6MxgwDQYJKoZIhvcNAQEL
BQAwbDELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
BAcMBkJvc3RvbjEZMBcGA1UECgwQUm9iaW4gUG93ZXJlZCBJbjEZMBcGA1UEAwwQ
cm9iaW5wb3dlcmVkLmNvbTAgFw0yNTExMTkyMTQwMTZaGA8yMTI0MTAyNjIxNDAx
NlowbDELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
BAcMBkJvc3RvbjEZMBcGA1UECgwQUm9iaW4gUG93ZXJlZCBJbjEZMBcGA1UEAwwQ
cm9iaW5wb3dlcmVkLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuiqF
+VDUiqzno9/DxbNfqjBxuimuONafe3vj2pY0uDoMK4YqSxUhbM1vWzsD+VE/fT4v
WItgBgHLHbacdXBC1Q6bldr6cvrNt+5EWDXM515VXpcGdR/Gnmy8DRQO5PbxMlY+
91YNxJC6sV+WOEiKj/+VN/JTMytFEI5A66xIxhUCAwEAAaNTMFEwHQYDVR0OBBYE
FOLPYJrHGWowwXqLXR6QrcWjpvpCMB8GA1UdIwQYMBaAFOLPYJrHGWowwXqLXR6Q
rcWjpvpCMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEAlICAw5Gt
0STxEXRfQWM9L5Ij/y/JZrb//YPy5n5SWrPT+g4tkAYw9k+juCit0xQ2ZeHleyV/
K94vYfOcCwegbkLJDfktbzlJxTWgb6cl71tbw0H5b/v8dNxGIh+1BYT5xuWjbecD
92oyqAFCDk4RltbxBD1Hvn52CtTEEIUUm2g=
-----END CERTIFICATE-----

Microsoft Entra ID

Follow the custom provider steps. Then, under Advanced Options, uncheck every box:

1. Under Auth Context, uncheck all boxes. Microsoft Entra ID then uses any sign-in method. A checked method that does not match how the user signed in causes error AADSTS75011.
2. Uncheck Encrypt Assertion and Encrypt NameID attribute. Microsoft Entra ID does not accept the encrypted NameID format that Robin asks for when Encrypt Assertion is checked.

For the full steps and error fixes, see Enabling single sign-on via Microsoft Entra ID.

Okta and Google Workspace

Okta and Google SAML have their own guides. See Enabling single sign-on via Okta and single sign-on with SAML for Google Workspace.

Delinea (formerly Centrify)

Follow the custom provider steps, and use this script to map the custom attributes:

setIssuer(Issuer);
setSubjectName(UserIdentifier);
setAudience('https://robinpowered.com');
setRecipient(ServiceUrl);
setHttpDestination(ServiceUrl);

setSignatureType('Response');
setNameFormat('emailAddress');

var FirstName = LoginUser.Get('GivenName');
var LastName = LoginUser.Get('sn');
var Email = LoginUser.Get('mail');

// Map IDP attributes to Robin
setAttribute('FirstName',FirstName);
setAttribute('LastName',LastName);
setAttribute('Email',Email);

// Optional for testing within Centrify
trace("FirstName is" + " " + FirstName);
trace("LastName is" + ' ' + LastName);
trace("Email is" + " " + Email);

Sign in with SAML

Members in your organization sign in on the login page with these steps:

1. Enter your email address.
2. Select Continue.
3. If your email address belongs to more than one organization, choose one.
4. Select the single sign-on button. For Okta, OneLogin or Rippling, the button shows the provider's name. For a custom provider, it says Single Sign-On.

You can also link directly to your SAML sign-in page to start SP-authentication right away: https://dashboard.robinpowered.com/login/saml/yourcompany. Replace yourcompany with your organization's username. Members need to know your organization's username (for example, robin or acme-inc) to start authentication with your SAML provider.

If you have trouble setting up your SAML configuration, contact the Robin support team for help.