--- title: Enable SAML for SSO slug: enable-saml-for-sso docTags: createdAt: 2025-08-11T11:13:48.000Z --- SAML (Security Assertion Markup Language) is an open standard that facilitates single sign-on (SSO) by allowing Swimlane Turbine (the service provider) to rely on external identity providers (IdPs) to authenticate users. By default, Swimlane supports a single identity provider per account. When the **Multi-SSO** feature is enabled, administrators can configure multiple SAML identity providers within the same account and assign users to the appropriate SSO configuration. Login can start from Turbine (**service provider–initiated**) or from your IdP (**identity provider–initiated**). ::::hint{type="info"} **Feature availability** Multi-SSO is controlled by a per-account feature flag. On the Account Settings **Features** tab, the flag appears as **Multi-SSO**. By default, Swimlane supports a single SAML identity provider (IdP) per account. When **Multi-SSO** is enabled for the account: - Administrators can configure multiple SAML identity providers and assign users to the appropriate SSO configuration. - Administrators can also configure multiple Directory Services configurations. See [Directory Services](docId\:kYGdTejbLYXAwquK65iZA). - When Multi-SSO is enabled for an account with an existing SAML configuration, all existing users are automatically mapped to that configuration so that their current SSO login continues without interruption. See the Automatic Migration of Existing Users section. To enable Multi-SSO, contact Swimlane Support. If you are a Turbine Platform (TP) customer, a Super Admin can enable the **Multi-SSO** feature flag for the account. **Prerequisite before enabling the flag:** If the account already has enabled SAML settings without an Identity Provider signing certificate, Turbine blocks enabling Multi-SSO and displays: :::BlockQuote **Failed to enable Multi-SSO feature flag** The existing SAML settings do not have a certificate configured. Add an Identity Provider certificate to the SAML settings before enabling Multi-SSO. ::: On the single-SSO **SAML Settings** dialog (**Sessions & Security**), paste the IdP signing certificate into the certificate text area or use **Upload Certificate**, then click **Apply**. Click **Save** on Account Settings, then enable **Multi-SSO** again. See the IdP signing certificate requirements section. :::: ## Choose Your Path | Goal | Go to | | --------------------------------------------- | ----------------------------------------------------------------------------------------------- | | Configure SAML when Multi-SSO is not enabled | Configure SAML Authentication section | | Configure multiple SAML IdPs (Multi-SSO) | Configure Multiple SSO Identity Providers section | | Values to enter in your IdP | Service Provider Metadata for Your IdP section | | Test the login flow | Test SSO Login section | | Require SSO for all users | Force SSO section | | IdP signing certificate requirements (26.3.0) | IdP signing certificate requirements section | | Provision users automatically | [Provisioning with SCIM Integration](docId\:uCYk5MLy9Erosd2-nvjpU) (SAML does not create users) | ## Benefits of SAML Authentication When the **Multi-SSO** feature is enabled, a Swimlane account can contain multiple active SAML identity providers. This allows organizations to authenticate different groups of users through different identity providers while maintaining centralized account management. Common use cases include managed service providers (MSPs) supporting multiple customers, organizations undergoing mergers and acquisitions, subsidiaries using separate identity systems, and contractor or partner access scenarios. - **Centralized User Management:** User authentication is managed through one or more external identity providers (IdPs), reducing administrative overhead while supporting multiple authentication sources within a single account when Multi-SSO is enabled. - **Scalability:** Supports large enterprises, MSPs, and multi-tenant environments by allowing multiple identity providers to coexist within a single Swimlane account when Multi-SSO is enabled. ## Prerequisites - **Account Admin** access to **Account Settings**. - A **Turbine user account** that already exists for each person who will use SSO. Turbine does **not** support just-in-time (JIT) user creation through SAML. Use [Provisioning with SCIM Integration](docId\:uCYk5MLy9Erosd2-nvjpU), Directory Services, or manual user creation to add users first. - Your IdP must send the user's **email address** as the SAML **Name ID**. The **Name ID Format** in Turbine is **Email address**. Turbine matches the Name ID to the user's **email** field only; username-based Name IDs are not supported. - The email in the SAML response must match an existing Turbine user. Matching is **case insensitive**. - **When Multi-SSO is enabled**, users must also be assigned to the appropriate SSO configuration before they can authenticate through that identity provider. :::hint{type="info"} If your account uses a **custom domain**, use that hostname in the **Service Provider Entity ID** when you configure your IdP. ::: :::hint{type="warning"} **IdP signing certificate required (Swimlane 26.3.0)** Every SAML configuration must include an Identity Provider signing certificate. On the single-SSO **SAML Settings** dialog, paste the certificate into the certificate text area or use **Upload Certificate**, then click **Apply** and **Save** Account Settings. On Multi-SSO, use **Certificate** / **Add Certificate**. You cannot enable **Multi-SSO** while an enabled SAML configuration is missing this certificate. For full details, see the IdP signing certificate requirements section. ::: ## Service Provider Metadata for Your IdP Provide these values to your IdP when you register Swimlane Turbine as a SAML application. | Metadata | Description | Value | | ------------------------------------ | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Service Provider Entity ID | Unique identifier for Turbine as the SP | `https://{your-swimlane-hostname}/tenant/api/saml/consume` | | Assertion Consumer Service (ACS) URL | URL where the IdP posts the SAML response | Same as the Service Provider Entity ID | | Name ID format | Format Turbine expects in the SAML assertion | **Email address** | | Single Sign-On URL | IdP endpoint Turbine calls to start login | Copy from your IdP | | Identity Provider Entity ID | Unique identifier for your IdP | Copy from your IdP metadata | | AuthnRequest signing | Whether Turbine signs authentication requests | Optional — **Sign AuthnRequest?** in **General Settings** (different certificate from the IdP signing certificate) | | IdP signature verification | Whether Turbine verifies the IdP signature | **Required.** SAML responses are always verified; there is no option to disable verification. Provide the IdP signing certificate (single-SSO: certificate text area / **Upload Certificate**; Multi-SSO: **Certificate**). Required beginning in Swimlane 26.3.0. | | Single Logout (SLO) | Federated logout URL | **Not supported** by Turbine | | Encrypted assertions | Whether assertions are encrypted | **Not supported** by Turbine | :::hint{type="warning"} **Important:** Turbine does not create users during SAML login. The Name ID email must match an existing user in your account before SSO will succeed. ::: ## Configure SAML Authentication Use this section when **Multi-SSO is not enabled** for your account. ### Single SSO :::hint{type="info"} Use this procedure when the **Multi-SSO** feature is **not** enabled. When Multi-SSO is enabled, configure identity providers from the Configure Multiple SSO Identity Providers section instead. ::: 1. Navigate to **Settings** > **Account** > **Account Settings**. 2. Open the **Sessions & Security** tab. 3. Expand the **Authentication** section. 4. Under **SAML Authentication**, turn **Enable** on. 5. Click **SAML Settings** to open the **SAML Authentication** dialog. 6. Complete the fields below, then click **Apply**. 7. Click **Save** on the **Account Settings** page to persist your changes. ### Identity Provider Settings | Field | Description | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name ID Format** | Read-only. Turbine expects **Email address**. Configure the same format in your IdP. | | **Identity Provider Entity ID** | Globally unique IdP identifier from your IdP metadata. Required. | | **Alias** | Short identifier used at login for alias-based SSO. Required, 1–200 characters, unique in your account. Cannot contain HTML-related characters: `<`, `>`, `"`, `'`, `&`, `(`, `)`, `{`, `}`, `;`. | | **SSO URL** | IdP single sign-on URL. Required. | | IdP signing certificate | **Required beginning in Swimlane 26.3.0.** Paste the IdP public signing certificate (PEM) into the certificate text area under **Identity Provider Settings**, or use **Upload Certificate**. Supported file extensions: `.txt`, `.cert`, `.crt`, `.pem`. Signature verification is always enforced. This is the certificate covered by the IdP signing certificate requirements section. | ### Service Provider Settings | Field | Description | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | | **Service Provider Entity ID** | Enter `https://{your-swimlane-hostname}/tenant/api/saml/consume`. Use the same value in your IdP application configuration. Required. | ### General Settings | Setting | Description | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Sign AuthnRequest?** | Optional. When enabled, upload a separate AuthnRequest signing certificate in PKCS #12 format (`.pfx` or `.p12`). Do **not** use a password-protected file. This is **not** the IdP certificate required for 26.3.0. To convert PEM key and certificate: `openssl pkcs12 -export -out cert.pfx -in cert.pem -inkey key.pem` | | **Preserve Whitespace in SAML Response?** | Enable only if your IdP includes insignificant whitespace that breaks signature validation. | **Force SSO** is configured at the account level under **Sessions & Security**, not in this dialog. See the Force SSO section. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/eGEK8JIWT6pvMOd6h-dl0_setupaliasinsamlauthenticationpage.png" size="40" width="800" height="589" darkWidth="800" darkHeight="589" position="center" alt="Single-SSO SAML Authentication dialog with Identity Provider Settings (including IdP certificate / Upload Certificate), Service Provider Settings, and General Settings (including optional Sign AuthnRequest)" showCaption="false"} ## Configure Multiple SSO Identity Providers (Multi-SSO) :::hint{type="info"} This section applies only when the **Multi-SSO** feature is enabled for your account. ::: Administrators can configure one or more SAML identity providers (IdPs) from the SSO page under Account Settings. ### Access the SSO Page 1. Navigate to **Settings** > **Account Settings** > **SSO**. 2. The SSO page displays all configured SSO providers, including: - **Name** — The SSO configuration name. - **Alias** — The unique identifier associated with the SSO configuration. - **Status** — Indicates whether the configuration is enabled or disabled. 3. Click **+ Add** to create a new SSO configuration. ### Basic Settings In the **Basic** section, configure the following fields: | Field | Action | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **SSO Name** | Enter a descriptive name for the SSO configuration. | | **Alias** | Enter a unique alias for the SSO configuration. The alias can include names, numbers, and special characters, and must be between 1 and 200 characters long. | The alias serves as a unique identifier for the SSO configuration and is used to route users to the appropriate identity provider during authentication. Alias values must be unique across all accounts in the region while the configuration exists. After you delete a configuration, its alias can be reused. Do not use HTML-related characters: `<`, `>`, `"`, `'`, `&`, `(`, `)`, `{`, `}`, `;`. ### Identity Provider Settings Configure the connection between Swimlane and the identity provider. ### Configuration Select one of the following configuration methods from the **Configuration** dropdown: **Metadata URL:** When you create or edit a Multi-SSO SAML configuration, select **Metadata URL** under Identity Provider Settings to configure the identity provider using its SAML metadata. Enter the federation metadata URL provided by your identity provider. Swimlane retrieves the SAML metadata XML and automatically populates the Identity Provider Entity ID, SSO URL, and signing certificate. Use this option when your identity provider provides a federation metadata URL. It simplifies configuration by eliminating the need to enter these values individually. If a metadata URL is not available, select **Manual** and enter the identity provider details manually. After entering the URL, click **Import** to automatically populate the following fields: - Identity Provider Entity ID - Single Sign-On (SSO) URL - Certificates: Add the identity provider certificate used to validate SAML responses from the identity provider. When **Configuration** is set to **Metadata URL**, the Identity Provider Entity ID and SSO URL fields are read-only. Use **Import** to populate them from the metadata document. To enter those values yourself, switch **Configuration** to **Manual**. :::hint{type="info"} **Metadata URL** is available when you configure SSO identity providers under Multi-SSO (**Settings** > **Account Settings** > **SSO**). The single-SSO **SAML Settings** dialog on **Sessions & Security** does not include Metadata URL import; enter IdP values manually there. ::: This option simplifies configuration by retrieving the identity provider details directly from the metadata document. **Manual:** Configure the identity provider manually by entering the required SAML settings. When using manual configuration, administrators must provide: | Field | Description | Example | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | | Identity Provider Entity ID | The globally unique identifier for the IdP that Turbine will use to verify the identity provider during authentication. It serves as the official name of the IdP in SAML transactions. | `https://.tld` | | SSO URL | The entry point for authentication requests from Swimlane Turbine to the IdP. It is where Turbine sends authentication requests to initiate the SSO process. | `https://identity-provider-domain.tld/saml2/turbinecloud` | **Identity Provider Certificate:** Upload the identity provider's public signing certificate. An identity provider signing certificate is required for SAML authentication. Swimlane uses this certificate to verify signed SAML responses from the identity provider. SAML response signature verification is always enforced and cannot be disabled. Supported certificate formats are **.pem** and **.cert**. :::hint{type="info"} Ensure that the certificate is accurate and matches the configuration in your IdP. Incorrect or expired certificates can cause SAML authentication failures. ::: ### Service Provider Settings Configure the Swimlane service provider settings required by the identity provider. Swimlane pre-populates the service provider settings required by your identity provider. Copy these values from Turbine and use them when configuring Swimlane as a service provider in your IdP. | Field | Description | Example | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | Service Provider Entity ID | The unique identifier for Swimlane Turbine as a service provider. This value is pre-populated in Turbine. Copy it and provide it to your IdP when configuring the SAML connection. It must be provided to the IdP to allow the IdP to trust and authenticate requests from Turbine. This ID is critical in establishing a secure SAML connection and must be configured accurately on both the IdP and Turbine sides. | `https://{swimlane-hostname-here}/tenant/api/saml/consume` | ### General Settings The following optional settings are available: ### Sign AuthnRequest - Signs authentication requests sent from Swimlane to the identity provider. - Select whether the SAML authentication request should be signed by Turbine by toggling the **Sign AuthnRequest?** option. - If enabled, upload the private key and public certificate in PKCS #12 format (`.pfx` or `.p12`). :::hint{type="info"} You can convert a PEM-formatted public certificate and key into PKCS #12 using the following command: ```javascript openssl pkcs12 -export -out cert.pfx -in pem-public-certificate.crt -inkey pem-private-key.key ``` Do not enter a password for the PKCS #12 certificate. Turbine does not support password-protected certificates. ::: ### Preserve Whitespace in SAML Response If your SSO provider includes insignificant whitespace in the SAML response signature, enable the **Preserve Whitespace in SAML Response?** toggle. **Force SSO** is not configured per SSO identity provider. Configure it at the account level under **Sessions & Security**. See the Force SSO section. ### User Mapping :::hint{type="info"} User Mapping is available only when Multi-SSO is enabled. Users cannot authenticate through an SSO identity provider until they are mapped to the corresponding SSO configuration. Creating a new SSO configuration does not automatically assign users to it. ::: After creating an SSO configuration, administrators must manually assign users through **User Mapping**, or assign the configuration from the user's **Authentication** settings or during user creation. Each user can be associated with only one SSO configuration at a time. A user already assigned to an SSO configuration cannot be assigned to another SSO configuration until they are removed from the existing configuration. To assign the user to a different SSO configuration, first unmap the user from the current SSO configuration, and then map the user to the new SSO configuration. Administrators can assign users using either of the following methods: ### Assign Individual Users Use the **Search users** field to locate and select individual users. The user list displays: - Name - Email address - Selection checkbox ### Assign Users by Group Use the **Filter by group** option to filter the user list by one or more groups. The user list is updated to display users who belong to the selected groups, making it easier to locate and select multiple users. After selecting the required users, save the SSO configuration to assign them. To remove assigned users, select **Clear selection** to clear the current user selection, and then click **Save** to apply the changes. :::hint{type="info"} Filtering by group is used only to locate and select users for bulk assignment to an SSO configuration. It does not create an ongoing association between the group and the SSO configuration. Users added to the group later are not automatically assigned to that SSO configuration and must be assigned separately. ::: :::hint{type="info"} Users can be assigned to an SSO configuration from either of the following locations: - **Settings** > **Account Settings** > **SSO** > **User Mapping** - **User Profile** > **Authentication** > **SAML Configuration** Both interfaces manage the same user-to-SSO relationship. Changes made in one location are automatically reflected in the other. For assignment during user creation, see [Users](docId\:iUzIdcolLvgz3X8qj4Ywj) and [Customize Your User Profile](docId\:PRWH3Nd3Y3C7Jl5OHbVH1). ::: After completing the configuration, enable or disable it using the **Enabled** toggle, then click **Save**. ### Manage Existing SSO Configurations The SSO page displays all configured SSO providers. For each configuration, administrators can open the actions menu (**⋮**) and select: - **Edit** — Modify the SSO configuration. - **Delete** — Remove the SSO configuration. - **Enable** / **Disable** — Activate or deactivate the SSO configuration. The **Status** column indicates whether the configuration is currently active. ### Automatic Migration of Existing Users When the **Multi-SSO** feature flag is enabled, Turbine runs an upgrade that links existing users (and related directory data) only when a single configuration of each type exists: - **Single SAML configuration:** Existing non-system users are automatically mapped to that SSO configuration so current SSO login continues without interruption. - **Single Directory Services configuration:** Existing directory-provisioned users and matching groups are linked to that Directory Services configuration. - **Zero or multiple SAML configurations:** Automatic SAML user mapping is skipped. Administrators must assign users through **User Mapping**, the user **Authentication** tab, or during user creation. - **Zero or multiple Directory Services configurations:** Automatic directory linking is skipped. After Multi-SSO is enabled, creating additional SSO configurations does not automatically assign users. Map users to each new configuration as needed. :::hint{type="warning"} A successful SAML login requires a user account that already exists in Swimlane and is assigned to the appropriate identity provider configuration. The Name ID value returned by the identity provider must match an existing Swimlane user's email address. Swimlane does not support just-in-time (JIT) user provisioning through SAML. ::: ## Correct Incorrect User Mapping If users are automatically mapped to the default SSO configuration: 1. Navigate to **Settings** > **Account Settings** > **SSO**. 2. Edit the default SSO configuration. 3. Remove the incorrectly mapped users. 4. Open the appropriate SSO configuration. 5. Map the users to the correct SSO configuration using **User Mapping**. Alternatively, update the user's **SAML Configuration** from the **Authentication** tab in the user's profile. See [Customize Your User Profile](docId\:PRWH3Nd3Y3C7Jl5OHbVH1). ## Test SSO Login ### Service Provider–Initiated Login 1. Go to the Turbine login page. 2. Click **Login via SSO**. 3. Enter your **alias** or **email address**: | Input | Behavior | | ----------------- | --------------------------------------------------------------------------------------------------------------- | | **Email address** | Turbine looks up your account and starts SAML authentication using the SSO configuration assigned to that user. | | **Alias** | Turbine routes login using the alias configured for the matching SSO configuration. | Some accounts show **Alias** only (alias-only login mode). With Multi-SSO, each SSO configuration has its own alias; enter the alias that corresponds to the identity provider you intend to use. 4. Complete authentication at your IdP. 5. Turbine validates the response and signs you in. ### Identity Provider–Initiated Login 1. Open the Turbine application from your IdP portal (for example, an Okta app tile). 2. The IdP sends a SAML response to Turbine. 3. Turbine validates the response and matches the Name ID email to an existing user who is mapped to that SSO configuration. ## IdP signing certificate requirements This section describes the Swimlane **26.3.0** Identity Provider signing certificate requirement in detail. Complete certificate setup before or while you configure SAML (see the Configure SAML Authentication and Configure Multiple SSO Identity Providers sections). ### Overview To strengthen the security of Swimlane's Single Sign-On (SSO) capabilities and support upcoming identity management enhancements, Swimlane is making the **Identity Provider (IdP) signing certificate** a required part of all SAML SSO configurations. On the single-SSO **SAML Settings** dialog, paste the IdP signing certificate into the certificate text area under **Identity Provider Settings**, or use **Upload Certificate**. On Multi-SSO configurations, use **Certificate** / **Add Certificate** (the UI shows **Certificate is configured** when a certificate is stored). It is **not** the optional certificate used with **Sign AuthnRequest?** in **General Settings**. This change improves the security posture of SAML authentication by ensuring that SAML assertions can be cryptographically validated and lays the foundation for future identity capabilities, including support for multiple SAML Identity Providers (Multi-SSO). ### Which Certificate Is Required? On the **single-SSO** **SAML Authentication** dialog (**Sessions & Security** > **SAML Settings**), two certificate controls appear. Only the IdP signing certificate is required for this change. The same dialog is shown in the General Settings section under Configure SAML Authentication. | Setting | Location | Required for 26.3.0? | Purpose | | ------------------------------------------------------------------------ | ------------------------------ | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IdP signing certificate (certificate text area / **Upload Certificate**) | **Identity Provider Settings** | **Yes** | The IdP public signing certificate (PEM). Swimlane uses it to validate that SAML responses come from your trusted IdP. Signature verification is always enforced; there is no toggle to disable it. | | **Sign AuthnRequest?** | **General Settings** | **No** (optional) | A separate PKCS #12 (`.pfx` / `.p12`) certificate that Swimlane uses to sign authentication requests it sends to the IdP. This is not the certificate covered by this notice. See General Settings under Configure SAML Authentication. | :::hint{type="warning"} **Single-SSO:** Paste the IdP signing certificate into the certificate text area under **Identity Provider Settings**, or use **Upload Certificate**. Do not confuse it with **Sign AuthnRequest?** under **General Settings** — that is a different, optional certificate. **Multi-SSO:** Use **Certificate** / **Add Certificate** on each SSO configuration (the UI shows **Certificate is configured** when a certificate is stored). See the Configure Multiple SSO Identity Providers section. ::: ### Why Is This Change Being Made? IdP signing certificates are an industry standard for establishing trust between an Identity Provider (IdP) and a Service Provider (SP). Requiring the IdP signing certificate allows Swimlane to: - Verify that SAML responses and assertions originate from a trusted Identity Provider. - Protect against identity spoofing and unauthorized authentication attempts. - Align with security best practices and modern SAML implementations. - Enable future Multi-SSO capabilities, allowing organizations to securely configure and manage multiple SAML Identity Providers within a single Swimlane account. ### How Does This Relate to Multi-SSO? **Multi-SSO** is available in **Turbine 26.3.0** when the feature flag is enabled for your account. As part of this enhancement, every SAML configuration must have an associated IdP signing certificate so each Identity Provider can be independently validated and trusted. You cannot enable **Multi-SSO** while an existing enabled SAML configuration is missing an IdP signing certificate. Turbine shows: **Failed to enable Multi-SSO feature flag** — *The existing SAML settings do not have a certificate configured. Add an Identity Provider certificate to the SAML settings before enabling Multi-SSO.* Under Multi-SSO, IdP signing certificates are **required**, and SAML response signature verification is **always enforced** — there is no option to disable verification. For accounts that use the single-SSO path on **Sessions & Security**, open **SAML Settings** and paste the IdP signing certificate into the certificate text area or use **Upload Certificate**, then **Apply** and **Save**. That certificate is required beginning in Swimlane 26.3.0 for new configurations and for any edit or save of an existing configuration. You are not required to enable Multi-SSO; the IdP certificate requirement applies to both paths. ### Release Timeline **Swimlane 26.3.0** Starting with version **26.3.0**: **Existing SAML configurations** - Existing SAML configurations without an IdP signing certificate will continue to authenticate users. - However, administrators will not be able to edit or save changes to those configurations until a valid IdP signing certificate has been uploaded (single-SSO: certificate text area / **Upload Certificate**; Multi-SSO: **Certificate**). **New SAML configurations** - All newly created SAML configurations must include a valid IdP signing certificate before they can be saved. This approach allows customers to continue normal authentication while providing time to update existing configurations before making future administrative changes. ### Will Certificate-Less SAML Be Deprecated? Yes. Support for SAML configurations without IdP signing certificates will be phased out over time as Swimlane completes the transition to the new security model. The **26.3.0** release is the first step in this migration. A future release will fully deprecate configurations that do not include an IdP signing certificate. Swimlane will provide advance notice and migration guidance before this occurs. ### What Do Customers Need to Do? We recommend completing the following as soon as possible: 1. Review all existing SAML SSO configurations. 2. Identify any configurations that do not have an IdP signing certificate. 3. Obtain the **IdP signing certificate** (public certificate / PEM) from your Identity Provider (such as Microsoft Entra ID, Okta, Ping Identity, Google Workspace, JumpCloud, or other SAML providers). 4. In Turbine, open **SAML Settings** (single-SSO) or the SSO configuration (Multi-SSO), Paste the IdP certificate into the certificate text area or use **Upload Certificate** (single-SSO), or use **Certificate** / **Add Certificate** (Multi-SSO). Then **Apply** / **Save** as required by that screen. Supported file extensions include `.txt`, `.cert`, `.crt`, and `.pem`. See the Configure SAML Authentication section. Updating your configurations now ensures you can continue to administer your SAML settings without interruption and prepares your environment for future Multi-SSO enhancements. ### Frequently Asked Questions **Which certificate do I need to upload?** The IdP public signing certificate under **Identity Provider Settings** (single-SSO: certificate text area / **Upload Certificate**; Multi-SSO: **Certificate**). It is not the **Sign AuthnRequest?** certificate under **General Settings**. **Will my users be able to continue logging in after upgrading to 26.3.0?** Yes. Existing SAML configurations without an IdP certificate will continue to authenticate users. The restriction only applies when an administrator attempts to modify that SAML configuration. **What happens if I create a new SAML configuration?** New SAML configurations require a valid IdP signing certificate before they can be saved. **Do I need to migrate immediately?** Authentication will continue to work for existing configurations, but we strongly recommend uploading the IdP certificate before you need to make any changes to your SAML settings. **Do I also need a Sign AuthnRequest certificate?** No. **Sign AuthnRequest?** remains optional. This notice applies only to the required IdP signing certificate under **Identity Provider Settings**. **Does this mean I must use Multi-SSO?** No. Multi-SSO is an optional capability. The IdP certificate requirement is part of the underlying security improvements and applies regardless of whether you choose to use Multi-SSO. ### Need Help? If you need assistance obtaining or uploading your IdP signing certificate, contact Swimlane Support or your Customer Success representative. ## Force SSO **Force SSO** requires users to sign in through SSO instead of a Turbine password. In Turbine 26.3.0, Force SSO is an account-level setting on **Settings** > **Account Settings** > **Sessions & Security**. It is not configured per SSO identity provider (including Multi-SSO configurations). To allow specific users to sign in with a password while Force SSO is enabled: 1. Open the user under **Settings** > **Users**. 2. Turn on **Exempt Force SSO**: - When **creating** a user, use the **Exempt Force SSO** toggle on the create-user form. - When **editing** an existing user, open the **Authentication** tab and turn on **Exempt Force SSO**. 3. Save the user. ## Limitations | Topic | Supported? | Notes | | ------------------------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Just-in-time user provisioning | No | Create users with SCIM, Directory Services, or manually before SSO. | | Username as Name ID | No | Use **Email address** Name ID format in your IdP. | | Multiple IdP configurations | Feature flag | Supported only when **Multi-SSO** is enabled; otherwise one SAML config per account. Enabling the flag requires an IdP signing certificate on any existing enabled SAML configuration. | | Single Logout (SLO) | No | — | | Encrypted SAML assertions | No | — | | Role assignment via SAML | No | Assign roles and groups in Turbine after the user exists. | ## Next Steps - Provision and deprovision users automatically: [Provisioning with SCIM Integration](docId\:uCYk5MLy9Erosd2-nvjpU) - Configure session timeout and password policies: [Sessions and Security](docId:9R_4c5NoIlgUUpePh0pD4) - Understand login options: [Turbine Login and Authentication Methods](docId\:Mhla1_pgceBnHSfrJwdzb) - Review Authentication fields on a user profile: [Customize Your User Profile](docId\:PRWH3Nd3Y3C7Jl5OHbVH1) - Configure Directory Services: [Directory Services](docId\:kYGdTejbLYXAwquK65iZA) - Create and manage users: [Users](docId\:iUzIdcolLvgz3X8qj4Ywj) - Groups provisioning columns: [Groups](docId\:qdacIONbFfCJiQJ6CdN__)