Enforcing SAML Single Sign On Across Your Team

1. Add the Hevo app

1. Log in to your SAML-enabled IdP such as Okta.

2. In the dashboard, click Add App.

   

   If you have configured applications in Okta previously, you may see the following screen. Click Add Application in this:

   

3. In the Add Application page, click Create New App.

4. In the pop-up window that appears, select the Platform as Web and Sign on method as SAML 2.0 and click Create.

5. In the General tab, specify the following App Settings including the name for the app.

6. Specify the following SAML Settings:

   • Single Sign-on URL: The URL for accessing the Hevo app. Use the URL from the Location field in the SP metadata that you copied above. For example, https://auth.hevodata.com/auth/saml/assertion.

   • Use this for Recipient URL and Destination URL: Select this check box.

   • Audience URI (SP Entity ID): The URL of the intended recipient of the SAML response. Paste the entity ID mentioned in the SP metadata XML file above. For example, http://samlsp.hevodata.com.

   • Default Relay State: Paste the relay state detail that you copied in Step 6-1 of section Retrieving Hevo App Settings above.

   • Attribute Statements - The attributes that will be included in the SAML assertion response sent by Okta for authenticating the user. At a minimum, you must add an email attribute as that is a mandatory attribute for Hevo. If this information matches what is entered by the user in Hevo, they get directly logged in.

     • Name: Specify the attribute name. For example, user-email to indicate an email ID.

     • Value: The information that the attribute holds. For example, user.email.

       

       In this example, Hevo validates the email ID entered by the user against the user-email field in the SAML assertion response received from Okta.

       Note: While you may select different IdPs such as Okta or OneLogin, Hevo mandatorily requires the users’ Email ID for authentication purposes.

7. Click Preview the SAML Assertion to view the information that is generated based on the details you entered above. A SAML assertion is the XML document containing the user authorization information that Okta would send to Hevo. For example, the attribute statement you entered above is included as follows:

   

8. If no further changes are needed, click Next and then, click Finish.

2. Assign users to the Hevo app

1. In your Okta dashboard, access the Applications page.

2. Click Assign Users to App.

   

   Alternatively, in the list of applications, click the Hevo app, and then click the Assignments tab.

   

3. Click the Assign drop-down and then click, Assign to People.

4. Search and add the users to the app.

5. Once all users are added, click Done. The users can now see Hevo in their Okta dashboard.

   

3. Retrieve IdP settings

When you add Hevo as an app in the IdP, it generates some configuration settings that you need for setting up SAML-SSO in Hevo.

Perform the following steps to retrieve these:

1. In your Okta dashboard, click the Hevo app, and then click the Sign On tab.

2. Click View Setup Instructions. Alternatively, click Identity Provider metadata.

   

3. Copy the information available on the page:

   • Identity Provider Single Sign-On URL

   • Identity Provider Issuer

   • X.509 Certificate. Click Download certificate to save the certificate file.

     You need to provide these details in Hevo.

Perform the following steps to add the Hevo app and set up single sign on in Azure Active Directory:

1. Add the Hevo app

1. Log in to your Azure account, and navigate to Azure Active Directory.

   

2. In the left navigation panel, select Enterprise applications.

   

3. Click + New application, and then click + Create your own application.

   

4. In the Create your own application page, do the following:

   1. In the What’s the name of your app?, enter Hevo.

   2. Select the Integrate any other application you don’t find in the gallery (Non-gallery) option to create a Hevo application in Azure Active Directory.

   3. Click Create.

      

5. In the Hevo Overview page, under the Getting Started section, select Set up single sign on.

   

6. In the Select a single sign-on method page, select SAML.

   

7. In the Set up Single Sign-On with SAML page, in the Basic SAML Configuration box, click Edit.

   

8. Specify the following settings:

   

   • Identifier (EntityID): The URL of the intended recipient of the SAML response. Paste the entity ID mentioned in the SP metadata XML file that you copied in step 6-2 of section Retrieving Hevo App Settings above. For example, http://samlsp.hevodata.com.

   • Reply URL (Assertion Consumer Service URL): The URL where Hevo receives the authentication token. Use the URL from the Location field in the SP metadata that you copied in step 6-2 of section Retrieving Hevo App Settings above. For example, https://auth.hevodata.com/auth/saml/assertion.

   • Relay State (Optional): The relay state includes details such as the team ID, Hevo environment, and the indicator that the login is occurring through the IdP. Paste the relay state detail that you copied in Step 6-1 of section Retrieving Hevo App Settings above.

9. Click Save.

You have successfully added Hevo as an application in Azure Active Directory.

2. Retrieve IdP settings

After you assign the basic SAML configuration settings in Azure AD, it generates a certificate and some configuration settings that you need for setting up SAML-SSO in Hevo.

In the Set up Single Sign-On with SAML page, perform the following steps to retrieve these:

1. In the SAML Signing Certificate section, download the SAML Certificate in Base64 format.

   

2. In the Set up Hevo section, copy the Login URL and Azure Ad Identifier, and store them in a secure location like any other password.

   

You need to provide these IdP settings while configuring SAML SSO in Hevo.

3. Assign users to the Hevo app

After adding Hevo as an app in Azure Active Directory, you must assign users to the app so that it is accessible to them through their dashboard.

1. In the Hevo Overview page, under the Getting Started section, select Assign users and groups.

   

2. Click + Add user/group to add users to the Hevo app.

   

3. Search and click on the user name that is displayed, to add the user. Repeat this for every user that you want to add to the Hevo app.

   

4. Click Select to add the user(s) to the Hevo app.

You have successfully added users to the Hevo app.

Refer to the following table for the list of key updates made to this page: