Configure SAML Authentication

Configure Okta as Identity Provider

This section explains how to configure Okta as the IdP for Gainsight PX SAML authentication so that your users can log in to Gainsight PX from Okta. 

To configure Okta as an IdP:

1. Log in to your Okta developer account.
2. Click Admin on the upper-right corner.

3. On the admin Dashboard, click Add Applications in the Shortcuts section.
4. Click Create New App on the Add Applications page. The Create a New Application Integration window is displayed. 
5. Select SAML 2.0 as the Sign on method.
6. Click Create.

7. In the App name field, enter a name for your application. The name you provide here is the name your users see in Okta for the PX widget.  
8. Click Next.

9. Click on the Configure SAML tab.
10. In the Single sign on URL field, enter https://app-be.aptrinsic.com/saml/SSO

Notes:

• For PX-EU users, the single sign-on URL/ACS URL is https://app-be-eu.aptrinsic.com/saml/SSO.
• For PX-US users accessing the US2 Data Center, the single sign-on URL/ACS URL is https://app-be-us2.aptrinsic.com/saml/SSO.

11. In the Audience URI (SP Entity ID) field, enter com:gainsight:px.

12. Click on the Feedback tab.
13. Select the I’m an Okta customer adding an Internal app radio button.
14. Click Finish.

15. In the Settings section of the Sign On tab on the Gainsight PX details page, copy the link address for Identity Provider Metadata.

16. Navigate to Gainsight PX and paste the URL in the Identity Provider Metadata Url field on the Login Settings page. 
    You can paste the URL either in the Saml Only section or Saml And Password section. The URL is automatically copied to the other section if you change your SAML authentication method later.

17. Click Save. Users can now log in to Gainsight PX from Okta.

Configure AuthO as Identity Provider

This section explains how to configure AuthO as the IdP for Gainsight PX SAML authentication so that your users can log in to Gainsight PX from AuthO.

To configure AuthO as an IdP:

1. Log in to AuthO.
2. Click + CREATE APPLICATION. The Create Application window is displayed. 
3. In the Name field, enter a name. 
4. Select the Regular Web Applications widget. 
5. Click Create.

6. On the Gainsight PX details page, click on the Addons tab.
7. Turn ON the SAML2 WEB APP toggle switch.
8. In the Application Callback URL field, enter https://app-be.aptrinsic.com/saml/SSO

Notes:

• For PX-EU users, the URL is https://app-be-eu.aptrinsic.com/saml/SSO.
• For PX-US users accessing the US2 Data Center, the URL is https://app-be-us2.aptrinsic.com/saml/SSO.

9. In the Settings section, enter the following code.

{
"audience": "com:gainsight:px",
    "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}

10. Click ENABLE.
11. Click the Usage tab.
12. Copy the URL from the Identity Provider Login URL field.
13. Click the Download link for the Identity Provider Metadata. 
14. Navigate to Gainsight PX and paste login URL and the metadata code in the Identity Provider Metadata Url field on the Login Settings page either in the Saml Only section or Saml And Password section. The URL is automatically copied to the other section if you change your SAML authentication method later.
15. Click Save. Users can now log in to Gainsight PX from AuthO.

Configure Google Workspace as Identity Provider

This section explains how to configure Google Workspace as the Identity Provider (IdP) for Gainsight PX SAML authentication so that your users can log in to Gainsight PX from their Google account.

To configure Google Workspace as an IdP:

1. Log in to Google Admin Console.
2. From the Admin console Home page, navigate to Apps and then Web and mobile apps.

3. Click Add App and then Add custom SAML app.

4. On the App Details page, enter a name for your application (here, Gainsight PX).
5. (Optional) Upload an image for your application. 

Note: If you do not upload an image, the first two letters of the app name are used to create an icon.

6. Click Continue.
7. From the Google Identity Provider details page, download the IdP metadata file.
8. Click Continue.

9. In the Service provider details page, enter the following information:

Field Name	Value
ACS URL	https://app-be.aptrinsic.com/saml/SSO Notes: For PX-EU users, the URL is https://app-be-eu.aptrinsic.com/saml/SSO. For PX-US users accessing the US2 Data Center, the URL is https://app-be-us2.aptrinsic.com/saml/SSO.
Entity ID	com:gainsight:px
Name ID format	UNSPECIFIED
Name ID	Basic Information > Primary email

10. Click Continue.

11. Click Finish.
12. Log in to Gainsight PX.
13. Navigate to Administration > SSO/SAML. 
14. In the Login Settings page, Select either the Saml Only or Saml And Password option.
15. Click on the G Suite (generic SAML 2.0) option.
16. Paste the xml code in the Identity Provider Metadata Url field. 

17. Click Save.

Microsoft Azure AD as Identity Provider

This section explains how to configure Microsoft Azure AD as the IdP for Gainsight PX SAML authentication so that your users can log in to PX from their Microsoft Azure account.

To configure Microsoft Azure AD as an IdP:

1. Log in to Microsoft Azure.
2. In the Azure Services section, click on Azure Active Directory.
3. In the Manage section on the left pane, click Enterprise applications.

4. In the All applications page, click New application.
5. In the Browse Azure AD Gallery page, click Create your own application.

Note: You need to create the Gainsight PX application in the Azure account as it will not be available in search.

6. Enter the name of the application as Gainsight PX.
7. Select the Integrate any other application you don't find in the gallery (Non-gallery) option.
8. Click Create. The Gainsight PX application is created.

9. Click Single sign-on on the left pane. The Set up Single Sign-On with SAML configuration section is displayed. You can also click on the Set up single sign on tile in the Getting Started section on the right side of the page.
10. In the Single sign-on page, click on the SAML tile. The Set up Single Sign-On with SAML page appears.

11. In the Basic SAML configuration step, click Edit and enter the following information:

Field Name	Value
Identifier (Entity ID)	com:gainsight:px
Reply URL	Specify the URL of the application to receive the SAML token. The reply URL is also called Assertion Consumer Service (ACS) URL. This is a mandatory field. Value: https://app-be.aptrinsic.com/saml/SSO Notes: For PX-EU users, the URL is https://app-be-eu.aptrinsic.com/saml/SSO. For PX-US users accessing the US2 Data Center, the URL is https://app-be-us2.aptrinsic.com/saml/SSO.
Sign-on URL	This value is not required. When a user launches the application from the Azure AD SSO URL, the IdP initiates the log in.
Relay State	(Optional) The URL to redirect the user after authentication is completed.
Logout URL	(Optional) Sends the SAML Logout responses to the application.

12. In the User Attributes & Claims step, enter the Unique User Identifier value as user.mail. 
13. In the SAML Signing Certificate step, click Edit and perform the following:
    1. From the Signing Option dropdown, select Sign SAML response and assertion.
    2. From the Signing Algorithm dropdown, select SHA-256. 
    3. Click Save.
    4. In the Federation Metadata XML field, click the Download link to download the IdP metadata file.