Organisation administration · Public
Configure SAML applications
Register SAML service provider applications in IAM, map every integration field, and connect them to Workforce Identity sign-in.
SAML applications connect enterprise service providers to Skyfallen ONE as the identity provider. Administrators register each service provider in IAM so ONE can accept its AuthnRequest, deliver signed assertions, and optionally expose the app on the workforce portal.
Prerequisites
If SSO → SAML Apps is missing from IAM, open Organisation and review Platform settings, or contact your Skyfallen Account Manager to enable SAML application management.
Members who complete SAML sign-in need the saml:auth permission and an enterprise ONE ID. Grant saml:auth separately from saml:manage.
| Requirement | Details |
|---|---|
| Tenant type | Enterprise |
| Tenant toggle | SAML application management enabled by Skyfallen |
| Permission | saml:manage on your membership |
| Tenant status | Active |
| Workforce Identity | Enabled for sign-in through the workforce portal |
IdP details for your service provider
Configure your service provider to trust ONE as the SAML identity provider.
ONE signs SAML responses. Match these values on the service provider before you register the application in IAM.
| Setting | Value |
|---|---|
| Entity ID / Issuer | https://auth.skyfallen.one/saml/metadata |
| Metadata URL | https://auth.skyfallen.one/saml/metadata |
| Name ID format | Email address |
Open SAML Apps
- Sign in at iam.skyfallen.one.
- Switch to the enterprise tenant you manage.
- Open SSO → SAML Apps.
Skyfallen managers can filter the list to one tenant or view all applications. Other administrators see only applications published by and accessible to their own tenant.
Create an application
Select New application. The form runs in five steps.
Save on the last step. ONE derives the internal application identifier from the Assertion Consumer Service URL automatically.
| Step | Purpose |
|---|---|
| Application | Name and description shown during sign-in and on the workforce portal |
| SAML integration | ACS URL, delivery endpoints, certificates, and protocol options |
| Legal | Privacy Policy and Terms of Service links |
| Access | Publisher and accessible tenant (Skyfallen managers only) |
| Session | Authorization code and SAML session lifetimes |
Field reference
Application
For non-manager administrators, the publisher is your current tenant and cannot be changed on this step.
| Field | Required | Limits | Notes |
|---|---|---|---|
| Name | Yes | 255 characters | Display name in sign-in flows and the workforce portal. |
| Description | Yes | 5,000 characters | Short summary of what the application does for members. |
SAML integration
Changing the ACS URL updates the internal identifier and any workforce portal references tied to the previous value. Plan ACS URL changes with your service provider administrator.
| Field | Required | Limits | Notes |
|---|---|---|---|
| Assertion Consumer Service URL | Yes | Valid URL, 512 characters | Endpoint where ONE posts SAML responses. Must match the ACS URL your service provider sends in its AuthnRequest. Each ACS URL can be registered once. |
| Destination URL | No | Valid URL, 512 characters | Where SAML responses are delivered. Defaults to the ACS URL when left empty. |
| Logout URL | No | Valid URL, 512 characters | Single logout endpoint for this service provider. |
| Launcher URL | No | Valid URL, 512 characters | URL the workforce portal opens when a member selects this application. Required for portal launch; direct SAML flows initiated by the service provider do not use it. |
| SP certificate | No | 10,000 characters | Service provider public X.509 certificate in PEM format. Required when Encrypt assertion is enabled. |
| Provider name | No | 255 characters | Optional label for the upstream vendor or identity system. |
| Use query parameters | No | — | When enabled, ONE appends SAML parameters as query strings instead of using an HTTP POST body. Enable only when your service provider requires it. |
| Encrypt assertion | No | — | When enabled, ONE encrypts SAML assertions for this service provider. Provide the SP certificate. |
Legal
| Field | Required | Limits | Notes |
|---|---|---|---|
| Privacy Policy URL | Yes | Valid URL, 2,048 characters | Shown where consent or legal disclosure is required. |
| Terms of Service URL | Yes | Valid URL, 2,048 characters | Shown where consent or legal disclosure is required. |
Access
Visible to Skyfallen managers only. Other administrators publish applications only for their own tenant.
ONE matches the signed-in member to the accessible tenant. The member must belong to that tenant and hold saml:auth.
| Field | Required | Notes |
|---|---|---|
| Publisher | Yes | Tenant that owns and publishes the application. |
| Accessible to tenant | Yes | Tenant whose members can complete SAML sign-in. |
Session
| Field | Required | Range | Default | Notes |
|---|---|---|---|---|
| Code expiry (seconds) | No | 5–600 | 30 | Lifetime of short-lived authorization artifacts used in related flows. |
| Session expiry (minutes) | No | 1–10,080 | 180 | Lifetime of the SAML session associated with this application. |
After registration
There is no application secret. Trust is established through SAML metadata, signatures, and optional encryption using the SP certificate.
| Action | Where | Notes |
|---|---|---|
| Edit fields | Row actions → edit, or click the row | Update integration, legal, and session values as your service provider changes. |
| Remove application | Row actions → Remove | Deletes the SAML registration. Portal entries that reference it must be removed separately. |
Publish on the workforce portal
SAML applications do not appear on the workforce portal until you add them under Apps in IAM. Set a Launcher URL before members can open the application from the portal.
Members with iam:apps can publish entries, set optional titles and groups, and upload icons. See Publish apps on the workforce portal.
Sign-in requirements
When a member initiates SAML sign-in, ONE checks:
- The AuthnRequest ACS URL matches a registered application.
- The signed-in account is an enterprise ONE ID.
- The member belongs to the application's accessible tenant.
- The membership includes
saml:auth.
If any check fails, sign-in stops.
Permission summary
Full definitions are in Tenant permissions reference.
| Permission | Who needs it | Purpose |
|---|---|---|
saml:manage |
IAM administrators | Create, edit, and delete SAML service provider applications |
saml:auth |
Members using the application | Complete SAML sign-in through Workforce Identity |
iam:apps |
Portal administrators | Add the application to the workforce portal |