SAML/SSO Setup Guide

How it works (2-Way Trust)

Setting up SSO requires a 2-way exchange of information between nLink and your Identity Provider (IdP):

• nLink needs to know about your IdP: To know where to redirect users for login and which key to use to verify them.
• Your IdP needs to know about nLink: To know where to send the login result (ACS URL) back to nLink.

Step 1: Obtain Configuration from IdP

Before configuring nLink, the administrator needs to create a SAML Application on the organization's Identity Provider (IdP) system:

1. Log in to the Admin Console of Okta or Azure AD.
2. Create a new SAML 2.0 Application.
3. Complete the basic setup steps. Once the application is created, the IdP system will provide a configuration file known as the IdP Metadata XML.
4. Please Copy the entire content of this XML file to use in the next step.

Step 2: Automatic Configuration on nLink

nLink provides an automated XML parsing tool that helps administrators quickly extract security parameters without manual configuration.

1. Log in to your nLink Workspace, navigate to Settings -> SAML/SSO.
2. Enable the "Enable SAML SSO for this Workspace" toggle.
3. Declare your trusted domains in the Domain Whitelist (e.g., @yourcompany.com). The system will automatically route email addresses with this suffix through the IdP login portal.
4. In the Import from IdP Metadata XML section, click the [Import XML] button.
5. Paste the entire XML content copied from Step 1 into the text area.
6. Click [Parse & Auto-fill] to let the system process it automatically.

Click [Save Configuration] to save your settings.

Step 3: Establish Connection from IdP (Trust Relationship)

After saving the configuration, nLink will automatically generate the Endpoint URLs under the Service Provider Setup section. Use this information to configure the application in Okta/Azure AD to establish a trusted connection:

1. Return to the SAML App on the Okta/Azure AD platform.
2. Locate the Single Sign-On URL (ACS URL) or Reply URL field:
   • Copy the ACS URL provided by nLink (e.g., https://app.yourdomain.com/api/v1/saml/acs/1) and paste it into the corresponding field.
3. Locate the Audience URI (Entity ID) or Identifier field:
   • Copy the Entity ID provided by nLink (e.g., https://app.yourdomain.com/api/v1/saml/metadata/1) and paste it into the corresponding field.
4. Ensure the User Identity Attribute (NameID Format) is set to EmailAddress.
5. Save the configuration and assign application access to the users or groups within your organization.