Set up SAML single sign-on
Single sign-on lets your members sign in to your community with your organization's identity provider, such as Okta, Microsoft Entra ID or Google Workspace. They use the account they already have at work, and you manage access in one place. Single sign-on is included on the Creator Plus and Sovereign plans.
Members keep the same mobieusID they already use. Their profile, posts, courses and history stay exactly where they are.
Before you start
You need to be a super admin of your community, and you need admin access to your identity provider and to your email domain's DNS.
Step 1: Add your community to your identity provider
Open Admin → Settings → Single sign-on. Copy the two values at the top into a new SAML 2.0 app in your identity provider:
- Entity ID (Audience URI):
https://your-community/sso/saml/metadata - ACS URL (Reply URL, Single sign-on URL):
https://your-community/sso/saml/acs
Set the NameID to the member's email address (or a persistent ID), and send the email as an email attribute. First and last name are optional. Sign the response or the assertion with SHA-256, and leave assertion encryption off.
Okta: Applications → Create App Integration → SAML 2.0. Put the ACS URL in Single sign-on URL and the Entity ID in Audience URI. Add attribute statements email, firstName and lastName. Assign the app, then copy the metadata URL from the Sign On tab.
Microsoft Entra ID: Enterprise applications → New application → Create your own application. Under Single sign-on, choose SAML and enter the Entity ID as Identifier and the ACS URL as Reply URL. Copy the App Federation Metadata Url, and assign users and groups.
Google Workspace: Admin console → Apps → Web and mobile apps → Add custom SAML app. Download the identity provider metadata, then enter the ACS URL and Entity ID, with Name ID format EMAIL and Name ID Primary email. Turn the app on for the people who should use it.
Step 2: Import your identity provider's details
Back on the Single sign-on page, paste the metadata URL and choose Import from URL. You can also paste the metadata XML, or enter the entity ID, sign-in URL and signing certificate by hand. Your community keeps a copy of the provider's signing certificate and checks every sign-in against it.
Step 3: Run a test sign-in
Choose Test sign-in. You sign in at your identity provider and come straight back to the settings page, which shows what your provider sent. If your provider sends your own email address, your account is linked too, so you can use single sign-on yourself. A successful test is required before you can switch sign-in on.
Step 4: Verify your email domains
Add each email domain your members use, such as example.com. The page shows a TXT record to publish in that domain's DNS. When it is published, choose Verify. A member's first single sign-on is matched to their existing account by email only for verified domains.
Step 5: Turn it on
- Allow SSO sign-in adds a Sign in with … button to your login page. You can choose the button's label.
- Create accounts on first sign-in gives people from a verified domain a member account the first time they sign in.
- Require SSO for members turns off password sign-in and self-registration for everyone except super admins. Super admins always keep their password sign-in, so you can always reach this page.
Good to know
- Start sign-in from your community's login page. Signing in from your identity provider's app dashboard is not supported.
- Signing out of your community does not sign you out of your identity provider.
- When your identity provider rotates its signing certificate, import its metadata again. Two certificates can be kept at once, so sign-in keeps working through the change.
- Administrator accounts are never linked automatically. Each administrator links their own account with a test sign-in.
Need help? Open a ticket with Mobieus support and include the message shown on the Single sign-on page.
