Skip to main content

SAMLv2 SSO Setup

Updated today

SAML2 SSO is a security standard that allows users to access multiple applications after signing in just once. SAML 2.0 (Security Assertion Markup Language) is an XML-based protocol that facilitates single sign-on (SSO) by securely passing authentication and authorization data between an identity provider (IdP) and a service provider (SP).

Instead of managing multiple logins, a user authenticates through their company's IdP, which then sends a signed SAML assertion to the SP, granting the user access. Fountain is compatible with any Identity Provider (IdP) that supports the SAMLv2 protocol.

Enabling SSO

To enable SAMLv2 SSO in your Fountain account, follow the steps below:

  1. Click your company logo in the bottom left side panel and then Settings.

  2. Under the Users section, click the User Access & Security link.

  3. Click Start under the User Single Sign-on (SSO) section.

  4. You'll need to copy the Fountain Service Provider (SP) Settings, such as the ACS URL and SP Entity ID, and paste them into your Identity Provider (IdP).

    1. Fountain also provides a SP Metadata URL, which can be directly pasted into most Identity Providers for your convenience.

  5. Locate the settings in your company's Identity Provider's platform. You'll need the Login URL, IdP Entity ID, and Certificate.

  6. Copy this information.

  7. Turn the Enabled toggle to "on" which will unlock the IdP fields.

  8. Paste the IdP information into the relevant fields in Fountain.

    1. You can typically leave the Alternative Email Key empty. More information on this field is in the next section of this article.

  9. Click Save.

  10. You can test the connection by logging in from an incognito browser.

Important Note:
Once enabled, all users MUST use SAMLv2 SSO to log in. There is no per-user bypass available.

Additional Considerations

During SSO setup, it is important to maintain your Fountain session. Once enabled, SSO enforcement is strict. Any misconfiguration (on either the IdP or SP side) will lock you out of your Fountain account, requiring you to contact the Fountain support team ([email protected]) to reset your company's SSO settings.

You can typically leave the Alternative Email Key empty. This setting is only needed when the user's common email address differs from the one used as the NameID. For example, users typically use addresses like [email protected], but the NameID returns a technical address such as [email protected]. In this scenario, you should map the public email address as an additional property in the SAML assertion and enter that property name in this field.

For Microsoft Azure SSO Setup steps, review this article.

Did this answer your question?