Setting up SAML SSO for your organization

Beefree App is now RGE Studio!
The email design suite you already know and love just leveled up. We’re working hard to update our help center, but you still may see some references to the old product name.

Overview

If you own an Enterprise account, you can require all account users to sign in with SAML SSO. It can be enforced on a domain or for the users of one RGE Studio account. If enforced on your domain, new users who sign up with your domain are directed to the Enterprise account owner.

SAML SSO setup requires actions from you and from RGE Studio. This article covers the steps on your side.

Set Up Your IdP

Complete these steps before you contact your Account Manager.

1. Set up your identity provider (IdP).
   1. Choose a compatible IdP, such as OneLogin or Azure AD.
   2. In your IdP, create a SAML application to connect with RGE Studio.
2. Generate and export your IdP metadata.
   1. Export the SAML metadata file from your IdP. This file usually includes:
      • The single sign-on URL
      • The single logout URL
      • The x509 certificate

Checklist

Use this checklist to gather everything you need. Then contact your Account Manager.

• Signing URL / SAML 2.0 Endpoint (HTTP):
  • Example from SAML metadata: <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<your-location>"/>
  • Replace <your-location> with your own URL.
• x509 Signing Certificate (.pem file)
• Request Signature Method:
  • Example: RSA-SHA256
• Service Provider Request Binding:
  • Example: HTTP POST
• List of email domains:
  • Example: reallygoodemails.com, beefree.io

Request Signature Method

You need your Request Signature Method to complete the checklist above. To find it:

1. Find the metadata XML file. This file contains your IdP metadata. Your IdP usually provides it when you set up SSO.
2. Open the file in any text editor or XML viewer.
3. Search the file for the SignatureMethod element. Most editors open search with Ctrl+F (Windows) or Cmd+F (Mac). Find the Algorithm attribute inside this element. Its value is your signature method.

<IDPSSODescriptor>
  <!-- Other elements -->
  <KeyDescriptor>
    <!-- Other elements -->
    <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
  </KeyDescriptor>
</IDPSSODescriptor>

Contact Your Account Manager

After you configure your SAML settings, contact your Account Manager. They'll send your settings to the RGE Studio engineering team. The engineering team then activates SAML SSO for your account.

Complete Your Configuration

To complete your SAML SSO setup:

1. Add the service provider (SP) details to your IdP. First, wait for your Account Manager to send you a connection name. They send it after they receive your SAML settings. Replace {yourConnectionName} with that name.
   1. For the Assertion Consumer Service (ACS) URL, enter: https://dev-5i55recuxv7xwvw8.us.auth0.com/login/callback?connection={yourConnectionName}
   2. For the Entity ID, enter: urn:auth0:dev-5i55recuxv7xwvw8:{yourConnectionName}

2. Map the SAML attributes. Add these attribute mappings in your IdP so users are set up correctly:

   {
     "name": [
       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
     ],
     "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
     "user_id": [
       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn",
       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
     ]
   }

Additional Considerations

Keep these points in mind before you set up SAML SSO:

• After you set up an email domain for SAML SSO, all users with that domain log in with SAML SSO. This applies even when they access other RGE Studio accounts. SAML SSO replaces Google SSO, Microsoft SSO, and standard login for these users.
• Specify the exact email domain to avoid login issues. For example, use amazon.fr instead of amazon.com if your users have amazon.fr addresses.
• Users log in only through the SSO button on the RGE Studio login page. IdP dashboards, such as OneLogin, don't open RGE Studio directly.