Skip to main content

Configure SSO for all providers

Requirements for SSO with any OIDC or SAML provider (Okta, Auth0, PingIdentity, OneLogin, WorkOS, Rippling). Covers claims, metadata options, and configuration.

Supported Identity Providers

F5 SurePath AI supports both OpenID Connect (OIDC) and SAML 2.0. Most major identity providers support one or both of these protocols, including (but not limited to):

  • Microsoft Entra ID (formerly Azure AD)

  • Okta

  • Auth0

  • PingIdentity

  • OneLogin

  • WorkOS

  • Rippling

Authentication Protocols

SurePath AI supports both OIDC and SAML authentication protocols. OIDC is recommended for its security features and simpler user experience; admins may choose either protocol based on the organization's requirements.

Initial Configuration Steps

  • Navigate to https://admin.surepath.ai

  • Click on Organization in the left menu column

  • Select the Identity tab

  • In the Identity Providers form, click + ADD PROVIDER

  • In the Provider Name field, enter a name for the IdP or SSO provider being added

  • In the Provider Type drop-down, select the type of provider being added:

    • OIDC

    • SAML

    • SAML - Metadata XML

    • SAML - Metadata URL

OIDC Configuration

Information SurePath AI Provides

  • Authorization Callback URL

    • Also known as Redirect URI, Reply URL, or Callback URL

    • This URL must be entered in the IdP's configuration

Information Required from the IdP

  • Client ID

    • Also known as Application ID

  • Client Secret

    • Also known as Application Secret or API Key

  • Issuer URL

    • Also known as Authority URL, OpenID Provider URL, or Issuer Identifier

Required claims for OIDC

SurePath AI requires specific claims in the ID token for authentication. The email claim is required, and most IdPs include it by default. The user's display name (either a single claim or combined first and last name claims) lets SurePath AI add user name information to User Activity and Telemetry events created during GenAI use.

Admins must configure the IdP to include the following claims:

  • Email claim

    • Standard claim name: email

    • Also known as: mail, emailAddress, or preferred_username (depending on IdP)

  • Display name claim (option 1 - recommended)

    • Standard claim name: name

    • Also known as: displayName, display_name, preferred_username, or nickname (depending on IdP)

  • Display name claims (option 2 - alternative)

    • If the display name claim is not available, configure both:

      • First name claim: given_name

        • Also known as: givenName, firstName, or first_name (depending on IdP)

      • Last name claim: family_name

        • Also known as: surname, lastName, last_name, or sn (depending on IdP)

      • SurePath AI combines these claims to create a display name

OIDC Configuration Steps

  • Enter the required information from the IdP into the corresponding fields

  • Click SAVE

  • Toggle the Enabled switch to the enabled position

  • Click SAVE again to activate the provider

SAML Configuration

IMPORTANT: Do not enable the SSO provider in SurePath AI until the configuration in the identity provider is complete. This ensures accurate metadata and prevents authentication issues. Complete all IDP configuration steps first, then return to SurePath AI to enable the provider.

Required claims for SAML

SurePath AI requires specific claims in the SAML response for authentication. The email claim is required, and most IdPs include it by default. The user's display name (either a single claim or combined first and last name claims) lets SurePath AI add user name information to User Activity and Telemetry events created during GenAI use.

Admins must configure the IdP to send the following claims (these become attributes in the SAML assertion):

  • Email claim

    • Common claim/attribute names: email, mail, emailAddress, or EmailAddress

  • Display name claim (option 1 - recommended)

    • Common claim/attribute names: displayName, name, or DisplayName

  • Display name claims (option 2 - alternative)

    • If the display name claim is not available, configure both:

      • First name claim: givenName, firstName, first_name, or GivenName

      • Last name claim: surname, lastName, last_name, sn, familyName, or Surname

      • SurePath AI combines these claims to create a display name

Option 1: SAML

Information SurePath AI Provides

  • Service Provider Entity ID

    • Also known as Issuer URL, Metadata URL, Audience URL, or Provider ID

  • Authorization Callback URL

    • Also known as Assertion Consumer Service (ACS) URL, SAML Consumer URL, Service Provider (SP) Response URL, or simply the SAML Endpoint

    • These values must be entered in the IdP's configuration

Information Required from the IdP

  • Entity ID

    • Also known as Issuer, IdP Entity ID, or Identifier

  • SSO URL

    • Also known as SAML Endpoint, Login URL, or IdP Sign-in URL

  • Provider Certificate

    • Also known as Identity Provider (IdP) certificate, SAML signing certificate, or encryption certificate

SAML Configuration Steps

  • Enter the required information from the IdP into the corresponding fields

  • Click SAVE

  • Complete the configuration in the identity provider using the information provided by SurePath AI

  • After the IdP configuration is complete, return to SurePath AI and toggle the Enabled switch to the enabled position

  • Click SAVE again to activate the provider

Option 2: SAML - Metadata XML

This option simplifies configuration by uploading the metadata XML file from the IdP.

SAML - Metadata XML Configuration Steps

  • Obtain the SAML metadata XML file from the IdP's administration console

  • Paste the entire XML content into the Metadata XML field

  • Click SAVE

  • Complete the configuration in the identity provider using the information provided by SurePath AI

  • After the IdP configuration is complete, return to SurePath AI and toggle the Enabled switch to the enabled position

  • Click SAVE again to activate the provider

Option 3: SAML - Metadata URL

This option lets SurePath AI automatically fetch and process the IdP's metadata.

SAML - Metadata URL Configuration Steps

  • Obtain the metadata URL from the IdP (must be publicly accessible)

  • Enter the URL into the Metadata URL field

  • Click SAVE

  • Complete the configuration in the identity provider using the information provided by SurePath AI

  • After the IdP configuration is complete, return to SurePath AI and toggle the Enabled switch to the enabled position

  • Click SAVE again to activate the provider

Related Articles
Did this answer your question?