Articles in this section

See more

Single Sign-On with SAML

  • Updated
Follow

Overview

Etlworks supports SAML single sign-on with identity providers such as Microsoft Entra ID, Okta, and PingFederate through the miniOrange-based SSO integration: the identity provider authenticates the user with SAML, and Etlworks receives a signed JWT that it verifies with the configured certificate.

Note: SSO is an enterprise feature available on Enterprise and on-premise plans.

Tip: If your identity provider supports OpenID Connect, consider Single Sign-On with OpenID Connect instead — it authenticates directly with the provider and does not involve an SSO broker. SAML remains the right choice when your organization standardizes on SAML.

Configure SSO in Etlworks

All settings live under Settings → Single Sign-On:

  • Provider: select miniorange. Existing environments with a configured Login URL and no selection continue to use this mode automatically.
  • Login behavior: required redirects users to SSO automatically; optional shows an SSO button together with local login.
  • Provider display name: the name shown on the login button, for example Microsoft Entra ID.
  • miniOrange Login URL: the Single Sign-On URL you receive from Etlworks support (Step 1 below).
  • miniOrange Logout URL: the Single Logout URL you receive from Etlworks support.
  • miniOrange Certificate: the certificate used to verify the JWT tokens returned to Etlworks.

Provisioning and account linking

These settings apply to both SAML and OpenID Connect SSO:

  • Unknown user provisioning: Existing users only rejects identities that do not match an Etlworks user; SSO Landing creates a Viewer in the protected landing tenant; Fixed tenant creates a Viewer in the tenant selected in the Tenant setting.
  • Link existing users by email (default on): on first login, the SSO identity is linked to an existing active user with the same email. Every subsequent login matches the linked identity — a changed email at the provider does not break or reassign the account.

Example: Microsoft Entra ID

Step 1. Contact Etlworks support and request the SAML configuration for your identity provider. You will receive the SP Entity ID (Identifier) and the ACS URL (Reply URL) to use in the steps below.

Step 2. Sign in to the Microsoft Entra admin center and open Entra ID → Enterprise applications.

Step 3. Click New application → Create your own application, enter a name (for example, Etlworks), select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

Step 4. In the application, open Single sign-on and select SAML.

Step 5. In Basic SAML Configuration, click Edit and enter the values from Step 1: the SP Entity ID as Identifier (Entity ID) and the ACS URL as Reply URL (Assertion Consumer Service URL). Save.

Step 6. In the SAML Certificates section, copy the App Federation Metadata Url (or download the Federation Metadata XML) and send it to Etlworks support so your Entra ID application can be established as the identity provider.

Step 7. Open Users and groups, click Add user/group, and assign the users or groups who should have access to Etlworks.

Step 8. Etlworks support will confirm the setup and send you the Login URL, Logout URL, and Certificate. Enter them under Settings → Single Sign-On as described above, set Provider to miniorange, choose the Login behavior, and save.

Step 9. Test: open the Etlworks login page in a private browser window. With Login behavior optional, click the SSO button; with required, you are redirected automatically. Sign in with an assigned Entra ID user.

Logout

Signing out of Etlworks ends the Etlworks session and follows the configured miniOrange Logout URL for provider logout, returning the user to the login page. The logout experience is consistent across local login, SAML, and OpenID Connect SSO.

Related articles