This guide explains how to configure Shibboleth Single Sign-On (SSO) with Archie using SAML 2.0. Once the integration is configured, employees will be able to log in to Archie using their existing organizational credentials.
Before you begin, ensure you have administrator access to Archie and access to your organization's Shibboleth identity provider (IdP) configuration.
Step 1: Configure Shibboleth
Provide the following Service Provider (SP) information to your IT team so they can register Archie with your Shibboleth identity provider.
Setting | Value |
SP Entity ID |
|
ACS URL |
|
SP Metadata URL |
|
Configure SAML attributes
Shibboleth uses XML-based configuration. Archie expects the following SAML attributes to be released using the specified FriendlyName values.
Ensure that your Shibboleth configuration sends all three attributes to Archie:
Email
FirstName
LastName
The attributes should use the following format:
<saml2:Attribute
FriendlyName="Email"
Name="Email"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
</saml2:Attribute>
<saml2:Attribute
FriendlyName="FirstName"
Name="FirstName"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
</saml2:Attribute>
<saml2:Attribute
FriendlyName="LastName"
Name="LastName"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
</saml2:Attribute>
Note: The example above illustrates the expected attribute names and format. Your IT team must ensure that the attributes are correctly configured and populated with the appropriate user values in the SAML response.
Step 2: Configure SSO in Archie
Once your Shibboleth identity provider is configured, complete the integration setup in Archie.
Log in to Archie with an administrator account.
Navigate to Settings → Integrations → App Marketplace.
Locate the SSO SAML integration and click View integration.
Click Connect identity provider.
Complete the configuration fields as described below.
Step 2: Configure SSO in Archie
Once your Shibboleth identity provider is configured, complete the integration setup in Archie.
Log in to Archie with an administrator account.
Navigate to Settings → Integrations → App Marketplace.
Locate the SSO SAML integration and click View integration.
Click Connect identity provider.
Complete the configuration fields as described below.
Configuration fields
Field | Value |
Provider | Select Other. |
Provider name | Enter a name to identify the integration, if needed. |
SSO URL | Enter your identity provider's login URL. |
Logout URL | Enter the URL where users should be redirected after signing out of Archie. |
Entity ID | Enter your Shibboleth identity provider's Entity ID. |
Certificate | Paste your identity provider's signing certificate. |
Provider name
The Provider name field can generally be left blank. If you have multiple SSO integrations, such as separate Shibboleth configurations for different user groups, adding a name can help distinguish between them.
Adding the signing certificate
When adding your certificate, keep the following points in mind:
Copy and paste the signing certificate itself, not a URL or download link.
Ensure the certificate is copied correctly and that no unintended spaces or line breaks are introduced.
If you copy the certificate through a text editor, double-check the formatting before pasting it into Archie.
6. Review the configuration to ensure all fields are correct.
7. Complete the connection process in Archie.
Step 3: Test the Integration
After completing the configuration, test the SSO connection to confirm that users can authenticate successfully.
Verify that:
Users can log in to Archie using their organizational credentials.
The user's email, first name, and last name are received correctly.
The login process completes without SAML authentication errors.
You're All Set!
Your Shibboleth identity provider is now configured for integration with Archie. Once the connection is verified, users can sign in to Archie using their existing SSO credentials.
If you experience any issues during setup, contact the Archie support team for assistance.