SAML Single Sign-on Setup

Okta

You can find Whimsical in Okta's Application Network and see a setup walkthrough here.

Google Workspace

Attribute mapping in Google does not happen automatically, but you should manually map the first name and last name attributes so that those get sent to Whimsical:

Azure Active Directory

Use the pre-built Whimsical integration in the Azure Active Directory Marketplace for the easiest setup experience.

If the Integration doesn't work for you, or you want to set up things manually, here are a few gotchas to keep in mind: 

• The EntityID and User Identifier format is still the same as before and listed at the top of this page

• The Reply URL (ACS URL) can be found in your Workspace Settings

• The User Attributes have to be WITHOUT Namespace, and the capitalization is important.

Example of a complete, working SAML setup:

Listing of all claims/attributes:

Example of how to remove the Namespace URI for a claim:

AuthO

While we don't have specific integration support for Auth0 at the moment, we have successfully setup Auth0 integrations with this minimal setup:

Replace the Application Callback URL with the ACS URL provided in Whimsical, and configure the rest of the values like this.

{
  "mappings": {
    "given_name": "givenName",
    "family_name": "LastName",
    "picture": "PhotoURL"
  },
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}
		

There may of course be other values in your configs, but these are the ones that matter to the Whimsical SAML integration.

Also please note that you may have setup Auth0 differently, and may have different names for values inside of Auth0. But these are the mappings, formats and probes that work for an out-of-the-box setup.

OneLogin

1. In OneLogin go to “Applications”, and click "Add app".
2. Search for “SAML Custom Connector (Advanced)”.
3. Enter the display name “Whimsical” and ensure that “Visible in portal” is checked.
4. Optional, upload this icon to more easily identify your Whimsical app in OneLogin. To save this file to your computer right click and choose "Save Image As...": 

   

5. Hit "Save", then go to the “Configuration” tab on the left.
6. Open the “More actions” dropdown in the top right corner and select “SAML metadata” this will download an XML file to your computer.
7. Go to your workspace settings in Whimsical, enable "SAML SSO", and select OneLogin as your identity provider.
8. Click “Select file”, open the XML file you just downloaded, and hit "Save".
9. Copy the ACS URL and paste it into the "ACS (Consumer) URL" and "Recipient" fields in the Configuration tab in OneLogin. 
10. Copy the Entity ID and paste it into the "Audience (EntityID)" field on the same tab. 
11. Paste this string into the "ACS (Consumer) URL Validator" field on the same tab:
    [-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&//=]*)
12. Save the configuration in OneLogin, then go to the "Parameters" tab. 
13. Click the plus button on the right to add a new parameter.
14. Name it “FirstName”, check the box to “Include in SAML assertion”, then click "Save".
15. Select “First Name” from the dropdown for value and save the parameter.
16. Repeat steps 14 and 15 but name the field “LastName” and choose “Last Name” as the value.
17. Click "Save" in the top right corner to save your parameters.

You can now assign Whimsical login to your users in OneLogin. 👍