Here's a guide to get started with SAML SSO with OneLogin for your Whimsical workspace.
Note: SAML SSO is only available on our Org plan. You must be an admin to enable SAML SSO.
1. In OneLogin go to Applications, and click Add app.
2. Search for "SAML Custom Connector (Advanced)".
3. Enter the display name "Whimsical" and ensure that "Visible in portal" is checked.
4. Optionally, upload this icon to more easily identify your Whimsical app in OneLogin.
5. Hit Save, then go to the Configuration tab on the left.
6. Open the "More actions" dropdown in the top right corner and select "SAML metadata". This will download an XML metadata file to your computer.
First, go to Workspace settings, which you'll find under your workspace name in the top left corner:
Then, enable SAML SSO. Once SAML SSO is enabled:
metadata.xml
file from step 2 in the “SAML Metadata XML” fieldCopy the “ACS URL” value
8. Paste the “ACS URL” value into the "ACS (Consumer) URL" and "Recipient" fields in the Configuration tab.
9. Copy the Entity ID and paste it into the "Audience (EntityID)" field on the same tab.
10. Paste this string into the "ACS (Consumer) URL Validator" field on the same tab:
11. Save the configuration in OneLogin, then go to the Parameters tab.
Click the + button on the right to add a new parameter.
12. Name it FirstName
, check the box to "Include in SAML assertion", then click Save.
13. Select "First Name" from the dropdown for value and save the parameter.
14. Repeat steps 15 and 16 but name the field LastName
and choose "Last Name" as the value.
15. Click Save in the top right corner to save your parameters.
16. You can now assign Whimsical login to your users in OneLogin.
After that’s done, go back to your Whimsical Workspace settings and adjust two more things:
There are some attributes that are the same for all identity providers:
Whimsical uses the e-mail address of the SAML user to identify them on Whimsical. This will come up with configuration options like Name ID Format or Name ID. When in doubt, try to choose the option that will return the user's e-mail.