Skip to main content
In this article, you learn how to set up a company login with any SAML 2.0 identity provider in anny. This is the right path for all systems that do not have their own guide, for example Okta, Auth0, Keycloak, Shibboleth, OneLogin, or Ping Identity.
For Microsoft 365 and Google Workspace there are dedicated articles with screenshots: Microsoft SAML SSO and Google Workspace SSO.

​
Preparation

You can set up the SSO connection yourself in your anny admin area under SSO & Security. Besides anny admin rights, you need administrative access to your identity provider. It is best to keep both systems open in two browser tabs, since you copy values back and forth between anny and your identity provider.

​
Setup

1

Create the identity provider in anny

Go to the SSO settings, select “Add IDP” and then choose “Custom SAML2” as the provider. Enter a name, for example “Company login”.
2

Enter the anny metadata in your identity provider

Under “1. Copy application metadata”, click “Show details”. There you find the values your identity provider needs for anny as a service provider. Create a new SAML application in your identity provider and enter the values.
3

Enter your identity provider's metadata in anny

Switch back to anny and fill in the form under “2. Insert SAML metadata”. The easiest option is “URL”: there you enter the metadata URL of your identity provider and anny reads all values automatically. Alternatively, select “Manually” and enter the values one by one.
4

Enable signing of the SAML response

Make sure the SAML response is signed in your identity provider. For security reasons, anny only accepts signed responses.
5

Test the connection and activate it

Save the configuration and test the connection via “Test Connection”. Once the login works, activate the identity provider via the three dots > Activate.

​
Values your identity provider needs from anny

You find all values in the SSO settings under “1. Copy application metadata” > “Show details”. The URLs follow this pattern, where {id} is the ID of your organization: Metadata URL: https://auth.anny.co/tenant/{id}/saml/metadata Certificate URL: https://auth.anny.co/tenant/{id}/saml/cert

​
Values anny needs from your identity provider

If you use the “Manually” option, you enter the following values:

​
Attributes

For the login, anny needs at least an email address as well as first and last name. How to map your identity provider’s attributes to anny and derive automatic community assignments from them is described in the Attribute Mapping article.
Important: anny only accepts signed SAML responses. If signing is not enabled in your identity provider, the login fails with the message “Signature missing”.

​
Common naming per identity provider

The terms differ between systems. This overview helps you match them.
Under Applications > Create App Integration, create a new application with “SAML 2.0”. Enter the anny ACS URL under “Single sign on URL” and the anny entity ID under “Audience URI (SP Entity ID)”. You then find your identity provider’s metadata URL under “Identity Provider metadata”.
Enable the “SAML2 Web App” addon in your Auth0 application. Enter the anny ACS URL as the “Application Callback URL” and the anny entity ID in the “audience” field of the settings. You find the metadata URL in the “Usage” tab.
Create a new client with the type “SAML”. Enter the anny entity ID as the “Client ID” and the anny ACS URL as the “Valid Redirect URI” as well as under “Master SAML Processing URL”. Make sure “Sign Documents” is enabled. The metadata URL is https://<your-keycloak>/realms/<realm>/protocol/saml/descriptor.
If your identity provider is part of a federation such as DFN-AAI or eduGAIN, use the Federated SAML article instead of this guide. There you select your identity provider directly from the federation.

​
After the setup

  • Via the three dots, you can generate a wayfless link. With it, your users land directly in the login of your identity provider.
  • With attribute mapping, you automatically assign users to communities.
  • With SCIM, you create user accounts automatically without the people having to log in first.
Here you find an explanation of potential error messages: SSO Troubleshooting