SAML/SSO Setup Guide

How It Works (2-Way Trust)

Setting up SSO requires a two-way information exchange between nLink and your Identity Provider (IdP):

• nLink needs to know about your IdP: To determine where to redirect users for login and which key to use for verification.
• Your IdP needs to know about nLink: To determine where to send the login result (ACS URL) back to nLink.

Step 1: Obtain Configuration from the IdP

Before configuring nLink, the administrator must create a SAML Application within the organization's Identity Provider (IdP) system:

1. Log in to the Admin Console of Okta or Azure AD.
2. Create a new SAML 2.0 Application.
3. Complete the basic setup steps. Once the application is created, the IdP system will provide a configuration file known as the IdP Metadata XML.
4. Copy the entire content of this XML file for use in the next step.

Step 2: Automatic Configuration in nLink

nLink provides an automated XML parsing tool that helps administrators quickly extract security parameters, eliminating the need for manual configuration.

1. Log in to your nLink Workspace, navigate to Settings -> SAML/SSO.
2. Enable the Enable SAML SSO for this Workspace toggle.
3. Declare your trusted domains in the Domain Whitelist (e.g., @yourcompany.com). The system will automatically route email addresses with this suffix through the IdP login portal.
4. In the Import from IdP Metadata XML section, click the [Import XML] button.
5. Paste the entire XML content copied from Step 1 into the text area.
6. Click [Parse & Auto-fill] to let the system process it automatically.

Click [Save Configuration] to save your settings.

Step 3: Establish the Connection from the IdP (Trust Relationship)

After saving the configuration, nLink automatically generates the Endpoint URLs under the Service Provider Setup section. Use this information to configure the application in Okta/Azure AD to establish a trusted connection:

1. Return to the SAML App on the Okta/Azure AD platform.
2. Locate the Single Sign-On URL (ACS URL) or Reply URL field:
   • Copy the ACS URL provided by nLink (e.g., https://app.yourdomain.com/api/v1/saml/acs/1) and paste it into the corresponding field.
3. Locate the Audience URI (Entity ID) or Identifier field:
   • Copy the Entity ID provided by nLink (e.g., https://app.yourdomain.com/api/v1/saml/metadata/1) and paste it into the corresponding field.
4. Ensure the User Identity Attribute (NameID Format) is set to EmailAddress.
5. Save the configuration and assign application access to the users or groups within your organization.