FOIAXpress Collaboration SAML SSO Login

Overview

The Sign On Mode page in FOIAXpress Collaboration allows administrators to integrate Collaboration with an external Identity Provider (IdP) that supports the Security Assertion Markup Language (SAML) 2.0 protocol.

When SAML-based Single Sign-On (SSO) is enabled, Collaboration delegates user authentication to your organization’s identity provider instead of using a separate Collaboration account. This configuration typically requires coordination with your IT or identity management team.

Regardless of the Identity Provider, the steps to configure Sign On Mode on Collaboration remain the same.

This manual is designed to assist administrators in configuring SAML SSO login for FOIAXpress Collaboration. It covers the following information:

Accessing the Sign On Mode page and selecting SAML SSO
Completing the SAML SSO Configuration wizard — Service Provider, Identity Provider (including the Identity Provider Certificate section), and Review & Save
Service Provider and Identity Provider field reference, including the Advanced Settings panels
Reviewing and saving the configuration

Accessing the Sign On Mode

You can configure Sign On modes for Collaboration directly from the Administration folder.

To access the page:

Navigate to Administration, then Security > Sign On Mode.

The Sign On Mode page allows you to configure how you authenticate into Collaboration. When enabled, SAML-based Single Sign-On (SSO) lets you sign in using your organization’s identity provider instead of a separate Collaboration account. This configuration typically requires coordination with your IT or identity management team.

Select SAML SSO from the Sign On Mode drop-down menu. The options are Forms and SAML SSO.

Forms Authentication

Select Forms to have users sign in with a Collaboration user name and password instead of an identity provider. Forms mode displays a single additional field:

NOTE: Membership Provider belongs to Forms mode only — it is hidden when you select SAML SSO.

SAML SSO Configuration

When you select SAML SSO, you must enter details for both the Service Provider (Collaboration) and the Identity Provider (your organization’s authentication system).

Move Through the SAML SSO Configuration Wizard

Selecting SAML SSO displays the SAML SSO Configuration wizard. A step indicator guides you through three steps: Service Provider, Identity Provider, and Review & Save.

• Click Next to move forward and Back to return to the previous step.

• Click a numbered step in the indicator to jump straight to that step.

• Required fields are marked with a red asterisk. If you leave one empty, a message such as Issuer / Entity ID should not be empty. is displayed beneath the field.

• Each step has its own collapsible Advanced Settings panel. Click the panel heading to expand or collapse it.

Step 1: Service Provider

Enter the Service Provider details for the relying party identifier.

These are shown below and described in the following table:

Field	Description
Issuer / Entity ID	Required. Enter the Collaboration login URL that your identity provider uses to identify the application. We recommend using the Collaboration application URL and avoiding unsupported characters. The URL must not contain a port number, query string, fragment identifier, ampersand (&), URN, or the substring "www" in the host name. You can also use a globally unique identifier, such as OrganizationApplicationNameEnvironmentType.
Assertion Service URL	Required. Specifies where the identity provider sends SAML responses after authentication. Collaboration populates this value automatically. Replace the host name with your own: `https://<hostname>/Collaboration/AssertionConsumerService.aspx`. Update the Service Provider Assertion URL in your SAML configuration and provide the updated URL to your identity provider.
Download XML Metadata	Downloads the service provider metadata XML file. Provide this file to your identity provider to register Collaboration

NOTE: The certificate fields moved into Advanced Settings and are described below. There is no Certificate Thumbprint field.

Service Provider Advanced Settings

Click Advanced Settings on the Service Provider step to display the following options.

Field	Field
Sign Authentication Request	Select this option to sign authentication requests that Collaboration sends to the identity provider.
Want Assertion Encrypted	Select this option to require the identity provider to encrypt SAML assertions before sending them to Collaboration.
Certificate	Select how the service provider certificate is provided: None, PFX Certificate, or Serial Number. Available certificate fields vary based on the selected option.

None — No service provider certificate is configured, and no certificate fields are displayed.
PFX Certificate — Displays Signature Certificate with a Select button, the Use same certificate for encryption checkbox, Signature Certificate Password, and a read-only Signature Certificate Expiration Date. Clearing the checkbox adds the matching Encryption Certificate, password, and expiration date fields.
Serial Number — Displays Certificate Serial Number and a read-only Certificate Expiration Date. The serial number is used to validate the certificates exchanged between systems.

NOTE: You need to provide either a Signature Certificate or a Certificate Serial Number. Make sure the application has permission to read the private key from the certificate file. The Signature Certificate and Encryption Certificate uploads accept .pfx files only. Expiration dates are read-only and show Auto-populated on update until a certificate is supplied.

Step 2: Identity Provider

Enter the Identity Provider values in the fields described in the following table:

Field	Description
Upload Metadata XML	Upload the metadata file provided by your identity provider. Only .xml files are supported. When you upload a valid file, Collaboration automatically populates the identity provider fields, which you can edit if needed.
Identity Provider Entity ID	Required. Enter the unique identifier that represents your identity provider.
SAML SSO URL	Required. Enter the identity provider endpoint that users are redirected to for authentication.
Test Connection	Validates the SAML SSO configuration using the current settings and displays the test result.

Click Advanced Settings in the Identity Provider panel to display these fields. All of them are provided by your identity provider if required.

Field	Description
SAML SSO URL Binding Type	Determines how messages are transmitted (for example, HTTP POST).
SAML SLO URL	Used if single logout is configured by your organization.
SAML SLO URL Binding Type	Determines how single logout messages are transmitted.
Name ID Format	Specifies the identifier format sent by your identity provider.
Authentication Context	Allows you to specify required authentication strength if your organization requires it.
Authentication Context Comparison	Sets how the requested authentication context is compared, if your organization requires it.

Identity Provider Certificate

Expand the Identity Provider Advanced Settings panel.

The Identity Provider Certificate panel sits below the Identity Provider panel on the same step.

1. If signing or encryption is required by your organization, you must enter the Signature Certificate Text and Encryption Certificate Text, respectively.

Field	Description
Signature Certificate Text	Enter the X.509 signing certificate provided by your identity provider. A read-only Signature Certificate Expiration Date appears below the certificate.
Encryption Certificate Text	Enter the encryption certificate provided by your identity provider. A read-only Encryption Certificate Expiration Date appears below the certificate.
Certificate	Optionally upload the identity provider certificate instead of pasting the certificate text. Supported file types are .cer, .crt, and .pem. A read-only IDP Certificate Expiration Date appears below the uploaded certificate.

You may upload and specify whether authentication requests, responses, and assertions must be signed or encrypted.

NOTE: Expiration dates display beneath each certificate field and read Auto-populated on update until a certificate is supplied. If a certificate cannot be read or has expired, you must upload a valid one before SSO can function. Admin users receive an automated email notification 30 days before certificate expiration.

Want SAML Response Signed
Want Assertion Signed
Force Authentication (prompts your identity provider to re-challenge at every login)
Sign Logout Request
Sign Logout Response

NOTE: Force authentication may increase login time because your identity provider will not reuse an existing session.

Step 3: Review & Save

The final step presents everything you have entered as read-only sections: Service Provider, Identity Provider, and Identity Provider Certificate.

Each setting is shown as a label and value. Anything you have not configured reads Not configured in muted text, and an enabled checkbox reads Enabled.
Long certificate text is truncated. Click Show More to expand it. The expiry is appended as (exp: YYYY-MM-DD).
Click Back to return to the Identity Provider step and make corrections.

Click Save on the Review & Save step to apply the configuration.