Skip to main content

General SSO Setup (SAML 2.0)

Enable centralized login for your team using Single Sign-On (SSO) through your organization’s identity provider.

Overview

Single Sign-On (SSO) lets your team access Knak securely without managing separate passwords. Instead, users authenticate through your identity provider using the SAML 2.0 protocol.

Before You Begin

  • Make sure you have admin access to your IdP.

  • Make sure you have the SSO configure permission in Knak. The Admin role has this permission by default.

  • This guide covers general SAML 2.0 setup. For steps for a specific IdP, see:

  • Have your IdP’s certificate file ready. Knak accepts .pem, .cert, or .cer files.

Step-by-Step Setup

1. Open SSO Setup in Knak

  1. Go to the Admin panel.

  2. Click Settings in the left-hand menu.

  3. Scroll to the Login section.

  4. Click Configure next to Single Sign-On (SSO).

    Login settings UI.

2. Create a SAML App in Your IdP

  1. Create a new SAML app in your IdP.

  2. Copy these two values from the Knak SSO page into your IdP. Use the copy button next to each field.

    • Single Sign on URL: Most IdPs call this the Assertion Consumer Service (ACS) URL.

    • Audience URI: Most IdPs call this the Entity ID.

    Set Up SSO IdP details.

  3. Set the Application Username Format to Email.

3. Add Your IdP Details in Knak

  1. Find these two items in your IdP:

    • The Identity Provider Single Sign-On URL

    • The X.509 Certificate file

  2. Paste the URL into the IdP Single Sign-On URL field in Knak.

  3. Click BROWSE next to the x509 Certificate field.

  4. Choose your certificate file. The file must end in .pem, .cert, or .cer.

    Required fields for Knak for SSO configuration.

4. Save Your Setup

  1. Click Save.

  2. Look for the success message.

SSO turns on as soon as you click Save the first time. You don’t need to turn it on separately.

After you save, the Enable SSO for your company toggle appears. Use it to turn SSO off or back on.

The SSO setup page with the Enable SSO for your company toggle highlighted

Update Your SSO Setup

You can change your IdP URL or certificate at any time.

  1. Make your changes on the SSO page.

  2. Click BROWSE and choose your certificate file again.

    Browse button highlighted in the x509 Certificate field.

  3. Click UPDATE.

You must upload the certificate every time you click UPDATE. This is true even if you only changed the URL. If you skip this step, you see the error “You must upload a public key certificate.”

Replace Your Certificate Before It Expires

After setup, the SSO page shows the date your certificate expires. Get a new certificate from your IdP before that date. Then upload it in Knak. If the certificate expires, your users can’t log in with SSO.

Additional Notes

  • Add every user to Knak before they log in with SSO. If a user signs in through your IdP but has no Knak account, they see a “user not found” page.

  • Knak supports both IdP-initiated and Service Provider-initiated login. IdP-initiated means users start from your IdP’s app list. Service Provider-initiated means users start from the Knak login page.

  • If users have trouble logging in, check that their IdP accounts are active and set up correctly. For more help, see Troubleshooting SSO Issues.

  • Choose whether users must log in with SSO or can also use a password:

    1. Go to Admin Settings.

    2. Open the Login tab.

    3. Turn on Username and Password Login to let users log in with a password on the Knak login page.

    4. Turn it off to Force SSO Login for all users.

      Username and Password login feature setting.

Note: If you turn SSO off, Knak turns Username and Password Login back on automatically. This keeps your users from being locked out.

To learn about all login choices, see Setting Up Login Options in Knak.

Need more help? Contact support via live chat within Knak using the chat bubble in the bottom right corner or email support@knak.com.

Related Articles
Did this answer your question?