Overview

Configure Single Sign-On (SSO) with OneLogin to give users secure, centralized access to Gainsight. Once authenticated in OneLogin, users can seamlessly access all authorized Gainsight applications without needing to log in separately to each one.

Prerequisites

To successfully configure SAML-based Single Sign-On (SSO), both the OneLogin and Gainsight administrators must create and configure the SAML application in their respective platforms:

• OneLogin Administrator: Set up the SAML application in the OneLogin portal.
• Gainsight Administrator: Mirror the configuration by creating the corresponding SAML app within the Gainsight platform.

Set up SAML SSO in OneLogin

Follow the steps below to set up SSO in OneLogin:

1. Sign in to OneLogin and click Administration. The Administration page appears.
2. Click the Applications tab, then select Applications from the dropdown menu. The Applications page appears.
   
   
    
3. Click Add App. The Find Applications page appears.
   
   
    
4. In the Search Box, enter SAML Custom Connector (Advanced) and select the result. The Configuration page appears.
   
   
    
5. Enter a Display Name for the application. 
6. Click Save.
    
    
7. From the left pane, click SSO. The Enable SAML2.0 page appears.
   
   
    
8. Under SAM 2.0 Endpoint(HTTP), click the Copy to Clipboard icon.
   
   
   
   Note: Save the copied endpoint for later use in Gainsight.
9. Click View Details, scroll down, and click Download. To download the X.509 PEM certificate.                        
   
   
   
   Note: By default, the X.509 PEM is selected; ensure this remains the same.
10. Click Certificates at the top. The Info page appears.
    
    
     
11. From the left navigation pane, click Parameters. The Parameters page appears.
12. Click the Plus icon to create a new field. The New Field dialog box appears.
    
    
     
13. Enter the Field Name as Username. 
14. Click Save. The Edit Field Username page appears.
15. On the Edit Field Username dialog box, provide the following details: 
    • Set Value to Email.
    • Select the Include in SAML assertion checkbox.
      
      
       
16. Click Save.

Setting up SAML in Gainsight

Follow the steps below to set up SAML in Gainsight:

1. Sign in to Gainsight and navigate to Administration > Users and Permissions > User Management. The User Management page appears.
2. Click the Authentication tab.
   
   
    
3. From the Add Authentication dropdown menu, select SAML. The SAML Mechanism dialog box appears. 
   
   
    
4. In the SAML Mechanism dialog box, provide the following details:

• Name: Enter a descriptive name for the app. For example:  OneloginSSO.
• Email Domain: Enter your organisation's domain.
• Sign In URL: Paste the SAML 2.0 Endpoint(HTTP) URL copied from OneLogin.
• Certificate: Upload the X.059 file downloaded from OneLogin.
  
  

5. Click Save. The newly added connection appears in the Connections list.
   
   
    
6. Click the three vertical lines next to the newly added Connection, and select Edit. The SAML Mechanism dialog box appears.
   
   
    
7. Click Download to download the metadata XML.
   
   
    
8. Extract the AssertionConsumerService Location and Entity ID from the downloaded XML file. Open the XML file and locate the following:

• AssertionConsumerService Location: This is the content in quotations for the location in line 27 from the example image below.
  
  
• Entity ID: Find the Entity ID at the top of the file. It is the blurred-out section from the example image below. 
  
  

Finalize OneLogin Configuration

Complete the OneLogin configuration by updating the application with values from the Gainsight metadata. Follow the steps below to configure the OneLogin page:

1. Navigate to the OneLogin Application setup.
2. In the left navigation pane, click Configuration. 
3. On the Configuration page, enter the following values from the Gainsight XML:
   • Audience (EntityID): Enter the Entity ID.
   • ACS (Consumer) URL Validator: Enter the AssertionConsumerService Location URL value.
   • ACS (Consumer) URL: Enter the same  ACS (Consumer) URL Validator (the AssertionConsumerService >  Location URL).
     
     

4. Click Save.

The SSO Login setup is complete. Assign users to the newly created OneLogin application to enable access to Gainsight.