Single Sign-On (SSO) with SAML 2.0

Overview

Single Sign-On (SSO) via SAML 2.0 allows your organization to manage user authentication through your existing Identity Provider (IdP), such as Okta, Azure AD, Google Workspace, or OneLogin. This centralizes user access control, improves security, and streamlines the login experience. Once configured, users can sign in to Elementum using their organization credentials, and you can enforce SSO-only authentication to ensure all access goes through your IdP.

Prerequisites

Before configuring SAML SSO, ensure you have:

Elementum permissions: Organization Admin access
IdP access: Administrator access to your Identity Provider (Okta, Azure AD, Google Workspace, OneLogin, etc.)
IdP configuration details:
- SSO URL from your IdP
- Issuer/Entity ID from your IdP
- X.509 signing certificate from your IdP
User attributes: Ensure your IdP sends firstName and lastName attributes in SAML assertions (and optionally jobTitle for job title syncing)

Elementum provides Service Provider (SP) metadata URLs that your IdP will need. These are displayed in the configuration interface and include the Assertion Consumer Service (ACS) URL and Audience URI.

Configuration Steps

Step 1: Navigate to SSO Settings

Log into Elementum as an Organization Admin
Navigate to Organization Settings
Select the Single Sign-On tab
Locate the SAML Configuration section

Step 2: Gather Elementum SP Metadata

Before configuring your IdP, you’ll need the Service Provider information from Elementum:

Copy the Assertion Consumer Service URL
- Example: https://se.elementum.io/api/v1/saml/callback
- This is where your IdP will send SAML responses
Copy the Audience URI (SP Entity ID)
- Example: https://se.elementum.io/api/v1/saml/metadata
- This uniquely identifies your Elementum instance to your IdP

Keep these URLs handy - you’ll need to enter them into your Identity Provider configuration in the next step.

Step 3: Configure Your Identity Provider

Configure a new SAML application in your Identity Provider. While specific steps vary by provider, you’ll typically need to:

Okta
Azure AD / Entra ID
Google Workspace
OneLogin
JumpCloud

In Okta Admin Console, go to Applications → Create App Integration
Select SAML 2.0 and click Next
Enter application name (e.g., “Elementum”)
Configure SAML settings:
- Single sign on URL: Paste your Elementum ACS URL
- Audience URI: Paste your Elementum Audience URI
- Name ID format: EmailAddress
- Application username: Email
Add attribute statements:
- firstName → user.firstName
- lastName → user.lastName
- jobTitle → user.title (optional)
Click Next and complete setup
Navigate to Sign On tab and click View SAML setup instructions
Copy the Identity Provider Single Sign-On URL, Identity Provider Issuer, and download the X.509 Certificate

The exact field names and navigation may vary depending on your IdP version. Consult your IdP’s documentation if you need specific guidance.

Step 4: Configure SAML in Elementum

Return to Elementum’s SSO configuration page and enter the information from your Identity Provider:

Enable SAML Authentication
- Toggle the Enable switch to activate SAML
Identity Provider SSO URL
- Paste the SSO/Login URL from your IdP
- This is where Elementum redirects users for authentication
Identity Provider Issuer
- Paste the Issuer/Entity ID from your IdP
- This identifies your IdP in SAML exchanges
Identity Connection
- Select Email from the dropdown
- This maps IdP users to Elementum users via email address
Identity Provider X.509 Certificate
- Paste the complete X.509 certificate from your IdP
- Include the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers
- Remove any extra whitespace or line breaks that may cause issues
Configure Inactive User Logout (optional but recommended)
- Desktop Users: Set hours of inactivity before automatic logout (default: 24 hours)
- Mobile Users: Set days of inactivity before automatic logout (default: 30 days)
Auto Create Unknown Users (optional)
- Enable this toggle if you want Elementum to automatically create user accounts when someone authenticates via SSO for the first time
- Requires firstName and lastName attributes in the SAML assertion
- If enabled and jobTitle is provided, the user’s job title will also sync
Click Save to apply the configuration

Do not enable “Enforce SSO-only authentication” yet. Test SSO thoroughly first to ensure it works correctly before enforcing it organization-wide.

Configuration Notes

Critical Attribute Mapping Requirements:

Case Sensitivity: Attribute names are case-sensitive. Ensure they match exactly (e.g., jobTitle vs JobTitle will cause issues)
Required Fields: firstName, lastName, and email claims are mandatory for automatic provisioning of new users when Auto Create Unknown Users is enabled
External Identifiers: If you select “External Identifier” in Elementum for the “Identity Connection” field, then a claim named externalId is also required in the SAML assertion
Job Title: The jobTitle attribute is optional but highly recommended for complete user profiles
NameSpace Values: For Azure AD/Entra ID users, ensure you remove the NameSpace values from Additional Claims or the integration will fail

Step 5: Test SSO Authentication

Before enforcing SSO, verify it works correctly:

Open an incognito/private browser window
- This ensures you’re testing a fresh login flow
Navigate to your Elementum login page
- You should now see a Sign in with SSO button
Click “Sign in with SSO”
- You’ll be redirected to your IdP’s login page
Log in with your organization credentials
- Enter your IdP username and password
Verify successful authentication
- You should be redirected back to Elementum and logged in
- Confirm your user profile shows correct information (name, email, job title if configured)
Test with multiple users
- Have several team members test the SSO flow
- Verify different user roles authenticate correctly

Testing Auto Create Unknown Users

If you enabled Auto Create Unknown Users:

Have a user who doesn’t yet exist in Elementum attempt to log in via SSO
Verify they can successfully authenticate
Check that their user account was automatically created
Confirm their profile contains:
- Email address (from SAML NameID)
- First and last name (from SAML attributes)
- Job title (if configured in SAML attributes)
Assign appropriate roles and permissions to the new user

Auto-created users will have minimal default permissions. Ensure you have a process to assign proper roles after their first login.

Testing Identity Connection Mapping

The Identity Connection setting determines how Elementum matches IdP users to existing accounts:

Email: Matches users based on email address (recommended)
This means the email in your IdP must match the email in Elementum

To verify:

Check that the SAML NameID or email attribute matches existing Elementum user emails
Test login with users who have accounts
Verify they log into their existing accounts (not new ones)

Step 6: Enforce SSO-Only Authentication (Optional)

Once you’ve thoroughly tested SSO and confirmed it works for all users:

Return to Organization Settings → Single Sign-On
Enable the Enforce SSO-only authentication toggle
Click Save

Critical: Once enabled, users will only be able to log in via SSO. Standard username/password authentication will be disabled. Ensure all users can access SSO before enforcing this setting.

Even with SSO enforcement enabled, Organization Admins can access a backup login method in case of IdP issues. Contact Elementum support for emergency access procedures.

Local Password Policy

For users who are not on SSO or before SSO is enforced organization-wide, Elementum enforces the following local password requirements:

Password Requirements:

Minimum Length: 12 characters
Complexity Requirements (must contain at least one of each):
- One lowercase character (a-z)
- One uppercase character (A-Z)
- One number (0-9)
- One symbol (e.g., !@#$%^&*()_+-=[]{}|;:'",.<>?)
Restrictions:
- May not contain the user’s name
- May not contain the user’s email address

Once SSO is enforced, these local password requirements no longer apply as all authentication goes through your Identity Provider.

User Experience

The login experience varies depending on your SSO configuration:

SSO Enabled (Not Enforced)
SSO Enforced

What users see:The login page displays a split interface giving users two options:

Top Section: “Log In With Email”
- Traditional username/password login
- Available for users with local accounts
- Subject to local password policy requirements
Bottom Section: “Log In With Single Sign On”
- Clickable button that redirects to your IdP
- Users authenticate using their organization credentials
- Recommended for all organization users

Use case: This configuration is ideal during the SSO testing and migration period, allowing users to choose their authentication method while you verify SSO works correctly.

Session Management

Desktop sessions: Expire after configured hours of inactivity (default: 24 hours)
Mobile sessions: Expire after configured days of inactivity (default: 30 days)
IdP session: If users are already logged into your IdP, they may experience automatic single sign-on without re-entering credentials
Session timeout: Applies regardless of SSO enforcement setting

Security Best Practices

Recommended Security Configuration

✅ Enable SSO enforcement after successful testing
✅ Configure automatic logout for inactive sessions
✅ Regularly rotate your X.509 certificates
✅ Enable Multi-Factor Authentication (MFA) in your IdP
✅ Use Auto Create Unknown Users only if you have proper onboarding processes
✅ Regularly audit user access in both your IdP and Elementum
✅ Monitor failed SSO authentication attempts
✅ Document your SSO configuration for your IT team

Certificate Management

Validity: X.509 certificates typically expire after 1-3 years
Rotation: When your IdP issues a new certificate:
1. Download the new certificate from your IdP
2. Update it in Elementum SSO settings before the old one expires
3. Test authentication to confirm the update worked
Monitoring: Set calendar reminders to check certificate expiration

User Provisioning

With Auto Create Enabled
Without Auto Create

Pros:

New users can access Elementum immediately
No manual account creation required
Scales easily for large organizations

Cons:

Users created with default minimal permissions
Requires post-login role assignment process
May create accounts for users who shouldn’t have access

Best for: Organizations with automated onboarding workflows and clear role assignment processes

Troubleshooting

Common Issues

SSO button doesn't appear on login page

Redirected to IdP but authentication fails

Cause: Incorrect IdP configuration or user not assigned to the applicationSolution:

Verify the user is assigned to the Elementum app in your IdP
Check that the IdP application is active/enabled
Confirm the SSO URL and Issuer are correct in Elementum
Verify required attributes (firstName, lastName) are configured in your IdP

Authentication succeeds but returns error in Elementum

Cause: Certificate mismatch, incorrect ACS URL, or missing required attributesSolution:

Verify the X.509 certificate is correctly copied (including headers)
Confirm the ACS URL in your IdP matches exactly what Elementum provided
Check that your IdP sends required SAML attributes (firstName, lastName)
Review browser developer console and network tab for specific error messages
Contact Elementum support with error details

Existing users can't log in after enabling SSO

Cause: Email mismatch between IdP and Elementum, or Identity Connection misconfiguredSolution:

Verify Identity Connection is set to Email
Confirm user emails in Elementum match emails in your IdP exactly
Check that IdP sends email in SAML NameID or as an attribute
Temporarily disable SSO enforcement to allow testing

New users aren't being created automatically

Cause: Auto Create Unknown Users is disabled, or required attributes are missingSolution:

Verify Auto Create Unknown Users toggle is enabled
Confirm your IdP sends firstName and lastName attributes in SAML assertions
Check attribute name spelling matches exactly (case-sensitive)
Review IdP logs to see what attributes are being sent

Certificate or configuration errors

Cause: Malformed certificate, expired certificate, or whitespace issuesSolution:

Verify certificate includes begin/end markers:

-----BEGIN CERTIFICATE-----
[certificate content]
-----END CERTIFICATE-----

Remove any extra spaces or line breaks
Check certificate hasn’t expired in your IdP
Download a fresh certificate from your IdP
Use a text editor (not Word) to copy/paste the certificate

User data isn't updating or looks incorrect

Cause: SAML claims from IdP are overwriting Elementum user dataSolution:

Claims sent by the IdP take precedence and will overwrite user-defined parameters in Elementum (such as Name, Last Name, and Job Title)
Update the values in your IdP user profiles instead of in Elementum
Verify the correct attributes are being mapped in your IdP configuration
Check IdP logs to confirm what values are being sent

Infinite redirect loop or being sent back to login page

Cause: Configuration mismatch between IdP and ElementumSolution: Check these three common issues:

URL Configuration: Ensure the ACS URL and Entity ID are not inverted or swapped
Unique Identifier: Verify the unique identifier (Name ID) is set to the user’s email address
Required Claims: Ensure all required claims (firstName, lastName, email) are being sent and properly formatted
Clear browser cookies and try in an incognito window
Check browser developer console for specific error messages

Job Title is not populating in user profiles

Cause: Missing or incorrectly named jobTitle attributeSolution:

Verify the jobTitle attribute is configured in your IdP
Check that the attribute name is exactly jobTitle (case-sensitive)
Common mistake: Sending JobTitle instead of jobTitle
Verify the IdP user profile contains job title data to send
Test with a user who has a job title populated in the IdP

Getting Help

If you continue experiencing issues:

Gather diagnostic information:
- Browser console errors
- Network tab showing SAML request/response
- IdP logs (if available)
- Exact error messages
Contact Elementum support with:
- Your organization name
- Identity Provider being used
- Steps to reproduce the issue
- Diagnostic information collected above

Advanced Configuration

Attribute Mapping

Elementum supports these SAML attributes:

Attribute	Required	Purpose	Example Value
`email` or NameID	Yes	User identification and matching	`[email protected]`
`firstName`	Yes*	User’s first name	`John`
`lastName`	Yes*	User’s last name	`Doe`
`jobTitle`	No	User’s job title	`Software Engineer`

*Required only when Auto Create Unknown Users is enabled SP-Initiated (default):

User starts at Elementum login page
Clicks “Sign in with SSO”
Redirected to IdP for authentication

IdP-Initiated:

User starts at IdP dashboard
Clicks Elementum app tile
Directly authenticated into Elementum

Both flows are supported. IdP-initiated login requires no additional configuration beyond the standard setup.

Summary

You’ve successfully configured SAML 2.0 SSO for Elementum:

Gathered SP metadata from Elementum (ACS URL and Audience URI)
Configured your IdP with Elementum as a SAML application
Entered IdP details into Elementum (SSO URL, Issuer, Certificate)
Tested SSO authentication with multiple users
Optionally enforced SSO-only authentication
Configured session management and user provisioning options

Your organization now benefits from:

✅ Centralized authentication through your Identity Provider
✅ Improved security with MFA support
✅ Simplified user onboarding (with Auto Create enabled)
✅ Consistent access control across applications
✅ Automatic session timeout for inactive users

For ongoing management, remember to:

Monitor certificate expiration dates
Audit user access regularly
Keep IdP user assignments up to date
Test SSO after any IdP configuration changes

Workflow & Automation

Agents

Working with Snowflake

Integration & Configuration

Data Management

Overview

Prerequisites

Configuration Steps

Step 1: Navigate to SSO Settings

Step 2: Gather Elementum SP Metadata

Step 3: Configure Your Identity Provider

Step 4: Configure SAML in Elementum

Configuration Notes

Step 5: Test SSO Authentication

Step 6: Enforce SSO-Only Authentication (Optional)

Local Password Policy

User Experience

Session Management

Security Best Practices

Recommended Security Configuration

Certificate Management

User Provisioning

Troubleshooting

Common Issues

Getting Help

Advanced Configuration

Attribute Mapping

Summary

Workflow & Automation

Agents

Working with Snowflake

Integration & Configuration

Data Management

​Overview

​Prerequisites

​Configuration Steps

​Step 1: Navigate to SSO Settings

​Step 2: Gather Elementum SP Metadata

​Step 3: Configure Your Identity Provider

​Step 4: Configure SAML in Elementum

​Configuration Notes

​Step 5: Test SSO Authentication

​Step 6: Enforce SSO-Only Authentication (Optional)

​Local Password Policy

​User Experience

​End User Login Experience

​Session Management

​Security Best Practices

Recommended Security Configuration

​Certificate Management

​User Provisioning

​Troubleshooting

​Common Issues

​Getting Help

​Advanced Configuration

​Attribute Mapping

​IdP-Initiated vs SP-Initiated Login

​Summary

Overview

Prerequisites

Configuration Steps

Step 1: Navigate to SSO Settings

Step 2: Gather Elementum SP Metadata

Step 3: Configure Your Identity Provider

Step 4: Configure SAML in Elementum

Configuration Notes

Step 5: Test SSO Authentication

Step 6: Enforce SSO-Only Authentication (Optional)

Local Password Policy

User Experience

End User Login Experience

Session Management

Security Best Practices

Certificate Management

User Provisioning

Troubleshooting

Common Issues

Getting Help

Advanced Configuration

Attribute Mapping

IdP-Initiated vs SP-Initiated Login

Summary