Learn how IT administrators can configure the integration between their IdP and Tulip to use SAML.
Users on Professional plans and above.
Prerequisites
- Review Tulip's guide on adding and managing users to understand the different types of roles in Tulip.
- Read the Authorization and Access Control using SAML guide to understand authorization and authentication methods supported by Tulip
Tulip-created SAML certificates expire yearly. Contact Tulip Support before the expiration date to rotate the certificate.
Connecting your IdP via SAML (all instances)
You will need to have the Account Owner role to set this up.
- Click your user profile in the top right of the screen, and select Settings.
- Select SAML from the list of options on the left.
From here, you can enable the SAML feature.
-
Download our Metadata XML file and create the Tulip application in your Identity Provider.
-
Tulip can accept a Metadata XML from your provider, or you can manually provide the following:
- SSO Login URL
- SSO Logout URL
- Certificates (in PEM format)
To verify SAML responses, the certificates for your IdP server must be in PEM format. You can enter multiple certificates separated by blank lines.
Set up user mapping
Learn about authorization and access control using SAML here.
Test the configuration
Use the Test SAML Authentication tool at the top right of the screen to ensure that your setup works correctly. This will ensure that at least one user can continue to log into the instance after the configuration has been saved.
When you click Authenticate, you can try to log in with any SAML user's credentials.
Any errors will be shown if the login fails.
If the login succeeds, all details from that SAML user will be displayed on the right side of the screen. The nameID will be successfully mapped into Tulip, and this user will be able to log into Tulip with their IdP credentials going forward.
After you have entered all the integration details, click Save button at the bottom.
Use badge ID login for the Tulip Player
By default, enabling SAML sends everyone through your IdP, including operators signing into the Player. If your shop-floor users don't have IdP accounts, you can switch Player login to badge ID instead.
This setting applies to the Tulip Player only.
This setting appears only after SAML is enabled on your instance.
- Click your user profile in the top right, then select Account Settings.
- Select Player from the list on the left.
- Under Login settings, enable badge ID login.
This setting applies to everyone who signs into the Player. It cannot be limited to certain roles or users. Anyone using the Player will need a badge ID set on their Tulip profile.
SAML SSO migration (existing instance only)
If you already use email/password to authenticate users, here's how to switch.
To switch and keep existing user data, your account needs a user migration to SAML.
Use the Migration tab at the top of the SAML page to ensure that all existing users can continue to use Tulip.
The CSV needs two columns in this order:
- Email: The email address the user uses to sign in to Tulip. If a user has no email address in Tulip, enter their badge ID instead.
- NameID: The SAML nameID of the user. The format is flexible, but it must be a unique ID that links a user's Tulip account to their SAML account. Every user in Tulip must have a distinct nameID in SAML.
- Do not include any headers.
- The nameID and badge ID are case-sensitive.
Make sure that you have already confirmed and verified that SAML is working in Tulip (see Testing Your SAML configuration). If you still need users to sign in with email and password, turn off SAML after you test.
After uploading the CSV, Tulip shows which users it mapped successfully. Mapped users can sign in with their SAML credentials immediately.
If using Azure, see Microsoft's Tutorial for using MS Entra with Tulip to confirm the Name ID format is correct. For an email Name ID format, change the format setting on the IdP to persistent.
Check your SAML logins over time
On the Users page, you can see which users have successfully logged in with their SAML credentials.
Use the Status column on the right side of the Users page to see each user's connection to your IdP.
Further reading
Did you find what you were looking for?
You can also head to community.tulip.co to post your question or see if others have solved a similar topic!