Skip to main content
Version: 0.94

Configure SAML SSO

This document will guide you through the process of setting up SAML-based authentication for single sign-on (SSO) in Snorkel Flow. By the end of the step-by-step guide, you will be able to log in to Snorkel Flow using your identity provider (IDP) mediated by SAML 2.0.

Prerequisites​

  • An existing Snorkel Flow deployment
  • Superadmin access to the Snorkel Flow deployment
  • A SAML 2.0-compatible Identity Provider (e.g. Okta, Google, or PingIdentity)

Configuring your identity provider​

We recommend having three windows open: one for Snorkel Flow, another for your IDP, and a third with these instructions. You will be asked to copy and paste metadata between the two systems.

Initial configuration​

Open the Admin Settings page in Snorkel Flow, and navigate to the Authentication Settings tab. Change SSO Status to Enabled and SSO Type to SAML.

warning

DO NOT set SSO Status to Required until you have successfully verified your setup, otherwise you risk being locked out of the instance. Once the SSO Status is set to Required, you will no longer be able to log in with username/password.

saml_setup_31.webp

Registering Snorkel Flow with your identity provider​

In order for your IDP to provide authentication for Snorkel Flow, you will need to provide information about your Snorkel Flow instance to your IDP.

First, in your IDP management console, add a new service provider. We recommend naming the service provider after your Snorkel Flow instance. Each IDP has their own name for service providers, such as “Applications” or “Connections.” Note that if you have multiple Snorkel Flow instances, you will need to repeat this for each instance.

Your IDP will then ask you to enter standard metadata about the newly created service provider. These can be retrieved from the Service Provider Settings section in Snorkel Flow.

  1. Service Provider Entity ID: Unique identifier that names your Snorkel Flow instance.
  2. ACS URL: URL where requests are sent after successful authentication with your IDP.
  3. Signed Response: Look for a checkbox that says “Sign Assertion & Response” or “Sign Response” and check it.
  4. ACS Binding: In many cases, this value is optional. Paste the value as given in the Snorkel Flow settings or look for an option called Binding and select Redirect.
  5. Name ID Format: Snorkel Flow uses each user’s email address for SSO login. Paste the value as given in Snorkel Flow settings or look for an option called Name ID Format and select “Email” or “Email Address”.
  6. X509 Certificate: Certificate provided by Snorkel Flow, often referred to as the Verification Certificate by IDPs. Paste the value for this certificate directly into this field in your IDP or upload file containing this content.
info

In the diagram below, the numbered fields correspond to the descriptions above.

saml_setup_11.webp

Registering your identity provider with Snorkel Flow​

  1. Identity Provider Entity ID: This may also be called the Issuer ID, and also tends to be a URL. Paste the value from your IDP here.
  2. SSO URL: This may also be called the SSO Service URL, and frequently will end with a code like start or startsso. Paste the value from your IDP here.
  3. SSO Binding: This is commonly the string urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, but if your IDP specifies a different value, paste it here.
  4. X509 Certificate: This is frequently a file downloaded from your IDP called the Signing Certificate. You may also see a body of text to copy and paste. Download this file, copy the contents and paste them into this field.

saml_setup_21.webp

Once you’ve finished the configuration above, click the Save button.

Testing the connection​

You can test the connection to your IDP by using the Test SSO button on the Admin Settings page. This will attempt to perform an authentication handshake between your IDP and your Snorkel Flow instance. If the connection is successful you will be redirected back to the Admin Settings page with a success message. If not, you will be presented an error message.

If you run into an error, review your steps through the guide above to ensure everything was configured correctly. If you need additional assistance, contact Snorkel AI support.

Requiring SSO login​

As an administrator, you can require that all Snorkel Flow authentication use your SSO provider. This is enabled by changing the SSO Status from Enabled to Required.

As a prerequisite, all users must have email addresses assigned to their profile in Snorkel Flow. Emails can be provided by Snorkel Flow administrators on the User Management tab on the Admin Settings page.

warning

DO NOT set SSO Status to Required until you have successfully verified your setup, otherwise you risk being locked out of the instance. Once the SSO Status is set to Required, you will no longer be able to log in with username/password.

Provider-specific guides​

PingIdentity​

Initial configuration​

  1. Add a Connection in the PingOne console.
  2. Select “Web App” as the application type.
  3. Select “Manually Enter” under app metadata.

Registering Snorkel Flow with your identity provider​

  1. Copy ACS URL from Snorkel Flow into the information pane.
  2. Download the signing certificate and open the file in a text editor. Copy and paste the content into the “x509 Cert” field under Identity Provider Settings on Snorkel Flow.
  3. Select “Sign Assertion and Response”.
  4. Leave the default Signing Algorithm in place.
  5. Do not enable encryption.
  6. Under the field Entity ID, copy the field called “Entity ID” under Service Provider Settings in Snorkel Flow. Paste this value into this field.
  7. Leave SLO Endpoint and SLO Response Endpoint blank.
  8. Set the field “Assertion Validity Duration (In Seconds)” to 300.
  9. Set the field “Target Application URL” to the URL of your Snorkel Flow instance. This is generally the same as the URL you pasted for the Entity ID.
  10. Select “Enforce Signed Auth Request”.
  11. Under the “Verification Certificate”, first copy the contents of the x509 Cert under the Service Provider Settings and paste it into a file. Save this file, then choose to import this file as the verification certificate on PingIdentity.
  12. Click Save and Continue.

Registering your identity provider with Snorkel Flow​

  1. From the list of Connections on PingIdentity, select the Snorkel Flow connection you just created.
  2. Click the menu button on the right side of the application.
  3. Click the “Configuration” tab in the Snorkel Flow application details.
  4. Copy the Issuer ID beginning with https://auth.pingone.com and paste it as the Entity ID under Identity Provider Settings in Snorkel Flow.
  5. Copy the Single Sign-on Service URL beginning with https://auth.pingone.com and paste it as the SSO URL under Identity Provider Settings in Snorkel Flow.
  6. Enter urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect as the SSO Binding under Identity Provider Settings in Snorkel Flow.
  7. Click Save in Snorkel Flow.