Enterprise SSO (SAML)
Enterprise SSO lets your team sign in to the LevelFour dashboard with your organization's identity provider (IdP) over SAML 2.0, instead of individual email or social logins. Once enabled, LevelFour routes anyone with an email address on your verified domain to your IdP to authenticate.
SSO is an enterprise feature. To enable it, contact your LevelFour representative or email support@levelfour.ai with your identity provider and the email domains your team signs in with.
Supported identity providers
- Google Workspace
- Microsoft Entra ID (formerly Azure AD)
- Okta
- Any SAML 2.0-compatible identity provider
How it works
Setting up SAML SSO is a one-time exchange of configuration between LevelFour (the service provider) and your identity provider:
- You tell LevelFour your IdP and email domain.
- LevelFour creates a connection for your domain and sends you the ACS URL (Assertion Consumer Service URL) and the Entity ID (service provider identifier).
- You create a SAML application in your IdP using those values and map a few user attributes.
- You send back your IdP SSO URL, your IdP Entity ID, and your X.509 signing certificate, or the full IdP metadata XML.
- LevelFour activates the connection and tests it with you.
LevelFour routes sign-ins by email domain, so your existing logins keep working until it activates the connection.
Required attribute mapping
Your IdP must send these attributes in the SAML assertion:
| User attribute | App attribute name | Required |
|---|---|---|
| Email address | mail | Yes |
| First name | firstName | No |
| Last name | lastName | No |
Set up Google Workspace
These steps use Google Workspace.
Create the SAML app
In the Google Admin console, go to Apps > Web and mobile apps, then click Add app > Add custom SAML app. Enter an app name (for example, "LevelFour") and click Continue.
Save your IdP details
On the Google Identity Provider details page, download the IdP metadata, or copy the SSO URL and Entity ID and download the Certificate. You will send these to LevelFour. Click Continue.
Enter the service provider details
In Service Provider Details, enter the ACS URL and Entity ID LevelFour sent you. Click Continue.
Set the Name ID and map the attributes
Set the Name ID format to EMAIL and the Name ID to Basic Information > Primary email.
Under Attributes, click Add mapping and map each Google directory field to its app attribute name:
- Basic Information > Primary email to
mail - Basic Information > First name to
firstName - Basic Information > Last name to
lastName
Click Finish.
Turn the app on
Open the app, go to User access, select On for everyone, and click Save.
Send LevelFour your IdP details
Send LevelFour the IdP metadata (or the SSO URL, Entity ID, and certificate) you saved from the Google Identity Provider details page.
Once LevelFour receives your IdP details, it loads them into your connection, tests a sign-in with one user on your domain, then activates SSO for the whole domain.
Other identity providers
The flow is identical for other providers. Create a SAML application in your IdP using the ACS URL and Entity ID LevelFour sends you, apply the same attribute mapping, and return your IdP metadata.
Next
- Authentication is the API key side: formats, scopes, rotation and revocation
- API keys is every method for creating, listing, rotating and revoking a key