SSO Sign in Configuration

WiseStamp provides an easy and secure way to streamline your sign in process with Single Sign-On (SSO) support. This guide provides you the information needed to configure SSO with popular identity providers such as Okta, OneLogin, and Azure. It walks you through the step-by-step process of setting up SSO in each of these platforms. By implementing SSO, you will not only enhance your account's security but also simplify the sign in process for your WiseStamp administrators.

!note!Please note, SSO sign in is only available in specific WiseStamp plans. For more information please contact your WiseStamp customer success manager or schedule a demo with one of our sales representatives.!/note!

Create the SSO domain

This procedure is performed by the WiseStamp support team. Once the SSO domain is created, you will be given the Provider ID, which is required for the following procedures. 

Configure SSO in Okta

To configure SSO in Okta:

1. Sign in to your Okta account.
2. From the left panel, select Applications > Applications.
3. On the Applications page, click Create App Integration.
4. On the pop-up, select SAML 2.0 and click Next.
5. On the Create SAML Integration page, enter WiseStamp for the App name and click Next. 
6. Configure SAML as follows:
   1. In the Single sign-on URL box, enter the following: 
      https://webapp.wisestamp.com/api/saml/callback
   2. In the Audience URI (SP Entity ID) box, enter the following: 
      https://webapp.wisestamp.com/api/saml/login
   3. In the Default RelayState box, enter the Provider ID given to you by the WiseStamp support team.
   4. In the Name ID format box, select EmailAddress.
   5. Click Next.           
7. For the Feedback definition, Okta needs to know more about WiseStamp. Perform the following:
   1. Select I'm an Okta customer adding an internal app.
   2. Select It's required to contact the vendor to enable SAML.
   3. Click Finish. The WiseStamp App Integration page appears.
8. Send the IP metadata information to WiseStamp, as follows:
   1. Go to the SAML Signing Certificates section, on the WiseStamp App Integration page.
   2. Select Actions > View idp metadata for the active certificate.
   3. The idp metadata is displayed. Select the metadata and copy it to a txt file.

Send the file to support@wisestamp.com, so WiseStamp can further configure the SSO. WiseStamp will inform you as soon as the SSO is working for your domain.

Assign permissions in Okta

You can select specific people or groups from your organization to assign permissions to the WiseStamp app. We recommend that you assign permissions to your administrators that manage WiseStamp, as only they will be able to sign in using SSO.

!tip! To assign permissions in Okta, go to the Applications page and click the Assignments tab. Then select the People and/or Groups of your administrators.!/tip!

Configuration SSO in Google Workspace

To configure SSO in Google Workspace:

1. Sign in to your Google Workspace account and go to the Admin console.
2. From the left menu, Click Apps and select Web and mobile apps. 
3. On the Web and mobile apps page, click Add app and select Add custom SAML app.
4. On the App details page, enter the name of the new app, such as “WiseStamp”, and click CONTINUE.
5. On the next page, click CONTINUE again. The Service provider details page opens.
6. Define the service provider information as follows:
   1. In the ACS URL field, enter the following: 
      https://webapp.wisestamp.com/api/saml/callback
   2. In the Entity ID field, enter the following: 
      https://webapp.wisestamp.com
   3. In the Default RelayState box, enter the Provider ID given to you by the WiseStamp support team.
   4. On the Name ID format dropdown list, select EMAIL.
   5. Click CONTINUE.
7. On the Attribute mapping page, click FINISH.
8. In the User access section, click ∨.
9. In the page that opens, select the groups and organization units to define the users, and click SAVE.
10. In the breadcrumb, click the name of the app to go to the previous page.
11. Send the Metadata XML code to WiseStamp, as follows:
    1. Click DOWNLOAD METADATA.
    2. On the popup, Click DOWNLOAD METADATA.
    3. Send the downloaded file to support@wisestamp.com, so WiseStamp can further configure the SSO. WiseStamp will inform you as soon as the SSO is working for your domain.

Configure SSO in OneLogin

To configure SSO in OneLogin:

1. Log into your OneLogin account.
2. Select Applications → Applications from the menu.
3. On the top right corner, click Add App.
4. Search for SAML test and select SAML Test Connector (Idp).
5. Select the Configuration tab and enter the following values: 
   • RelayState -> [Obtain from WiseStamp]
   • Audience -> https://webapp.wisestamp.com/api/saml/login
   • Recipient -> https://webapp.wisestamp.com/api/saml/login
   • ACS (Consumer URL validator) -> https://webapp.wisestamp.com/api/saml/login
6. In the top right corner, click More Actions and select SAML Metadata. This downloads an XML file to your computer.
7. Share the downloaded XML file with WiseStamp at support@wisestamp.com.
8. A WiseStamp representative will then provide you with the RelayState ID.
9. Paste the RelayState ID provided by the WiseStamp representative in the RelayState field.

!important! Click Save to complete the app creation. !/important!

Configure SSO in Azure

To configure SSO in Azure:

1. Sign in to your Azure account and go to Enterprise applications.
2. Click New application. The Browse Microsoft Extra Gallery page opens.
3. Click Create your own application.
4. Enter the name of the new app, such as WiseStamp, and click Create. The configuration page for the new app opens.
5. Click Properties from the left menu and set Assignment required to No.
6. Click Save.
7. Optionally, click Owners from the left menu. Then click add and select the owner from the list of users.
8. Click Users and groups from the left menu. 
9. Select the specific people or groups from your organization to assign permissions to the app and click Assign..
   !tip!We recommend that you assign permissions to your administrators that manage WiseStamp, as only they will be able to sign in using SSO.!/tip!
10. Click Single sign-on from the left menu and click SAML.
11. Define the basic SAML configuration as follows:
    1. In the Basic SAML configuration section, click … and select Edit.
    2. In the Identifier (Entity ID) section, click Add identifier and enter the following: 
       https://webapp.wisestamp.com
    3. In the Reply URL (Assertion Consumer Service URL) section, click Add reply URL and enter the following: 
       https://webapp.wisestamp.com/api/saml/callback
    4. In the Sign on URL (Optional) section, enter the following: 
       https://webapp.wisestamp.com/api/saml/login?sso_provider_id=<provider_id>
       Where, <provider_id> is the Provider ID given by the WiseStamp Support team.
       For example, if Provider ID = 1234567890123456, enter the following:
       https://webapp.wisestamp.com/api/saml/login?sso_provider_id=1234567890123456
    5. Click Save and close the popup.
12. Define the clams as follows:
    1. In the Attributes & Claims section, click … and select Edit.
    2. In the Additional claims list, click the row where the Value is set to user mail. The Manage claim page opens for this claim.
    3. Change the value for the Name to email (delete the word "address").
    4. Delete the value for Namespace to leave the field blank.
    5. Click Save
    6. Close the Attributes & Claims page by clicking SAML-based Sign-on in the breadcrumbs. .
13. Send the Federation Metadata XML code to WiseStamp, as follows:
    1. In the SAML Certificate section, click Download to the right of Federation Metadata XML.
    2. The Federation Metadata XML code is displayed. Select the code and copy it to a txt file.
    3.  Send the file to support@wisestamp.com, so WiseStamp can further configure the SSO. WiseStamp will inform you as soon as the SSO is working for your domain.