Moesif provides a single sign-on integration with SAML identity providers.
In order to set up SSO:
- You must be able to configure your idenitity provider
- You must be on an enterprise plan with SSO enabled
How SSO works
Moesif single sign-on implementation leverages Home Realm Discovery to select the correct tenant based on the email’s domain name. Once SSO is enabled, any employee logging in with your company’s domain will automatically be redirected to the single sign-on page. Team management and role-based access control is handled by your identity provider rather than within the Moesif application.
How create a SAML app using Okta
This guide shows how to set up a generic SAML app with a generic SAML identity provider. To make your set up easier, Moesif has integrations with specific identity providers. If you’re IdP is Okta, you should follow this guide instead.
1. Go to Applications within the Okta admin dashboard
Click the Add Application button
2. In the applications directory, click Create New App
3. In the popup select Web from the dropdown and then select SAML 2.0
4. Enter a name for the app and optionally upload a logo
You can download the Moesif logo here
5. On the next step, enter your single sign on URL and Audience URI
The single sign on URL looks like
The Audience URI looks like
You can obtain your single sign on URL and Audience URI by emailing your Moesif technical account manager or email@example.com
Besides filling in the Single sign on URL and Audience URI fields, you will need to map four fields under Attribute Statements as specified below:
All other fields can be left to their default values.
6. On the next step, select I’m an Okta customer adding an internal app and select finish
7. Finally, select View Setup Instructions in the yellow box
After clicking View Setup Instructions, you’ll see the Identity Provider Single Sign-On URL and your X.509 Certificate for the newly created application. Email both of these items to your Moesif technical account manager who will finalize linking your Moesif organization to your IdP application.
8. Add role field (Optional)
To manage role-based access control for Moesif within your identity provider, you can add a field role to the Moesif appuser.
Within the Okta admin portal, go to Directory -> Profile Editor, and select the Edit Profile button next to the newly created Moesif application.
Click on Add Attribute on the left side and add a field role as shown in below screenshot.
Checkbox Define enumerated list of values and add the three predefined roles supported by Moesif:
If your Moesif subscription has any custom roles, you can also add their names to this list.
After SSO activated
Once SSO is enabled:
- Team members will no longer be able to log in with a password or social account.
- Password reset is disabled.
- Administrators will no longer be able to add/remove team members within Moesif.
- Role-based access control is synced from your identity provider and cannot be changed within Moesif.
Any employee logging in with your company’s domain will automatically be redirected to the single sign-on page where they can click log in. All team management and role-based access control actions is done through your identity provider. Moesif automatically syncs user accounts.
An organization can disable SSO at any time by contacting their technical account manager. Once disabled, existing team members who already had an account prior to SSO can log in with their password. New users who were provisioned through SSO can reset their password to log in.