We know how important is to be SAML / SSO compatible for some companies.
Now you can use SAML 2.0 protocol to connect to Tomorro in the most secure way.
This allows you to bring in your favourite Identity provider and connect to Tomorro via SSO for the highest standard authentication.
Connect on Tomorro
In order to set up the integration, please go to the integration setup page on Tomorro and open the section SAML Authentication to start the setup. Only admins have access to this section.
💡 If your organisation has moved to the new SSO, the SAML Authentication section also shows Identity providers on the new SSO. You manage your identity providers yourself: Add identity provider, then Edit, Delete or Set as default. Each provider is configured with a Name, an Email domain, an Issuer, an Entrypoint and an x509 Certificate ; the email domain determines which users are directed to that provider. You can register up to three identity providers in total. Availability depends on your organisation's plan ; to get access, contact your account manager.
Setup on Azure
STEP 1 - Create a custom app on AZURE
STEP 1 - Create a custom app on AZURE
Go to Entreprise applications > Click on the button “New application”
Then click on the “Create your own application” button.
You can choose the name of your app, “Tomorro” for instance
And select the option “Integrate any other application you don’t find in the gallery”.
STEP 2 - SAML Certificate
STEP 2 - SAML Certificate
Copy the Azure AD Identifier and paste it to the field Issuer of Tomorro
URL should look like
https://sts.windows.net/XXX
Copy the Login URL and paste it to the field Entrypoint of Tomorro.
URL should look like
https://login.microsoftonline.com/XXX
Download the Certificate Base 64, open it and paste the data in the field x509 Certificate.
Structure of Base 64 Certificate
-----BEGIN CERTIFICATE----- [CERTIFICATE] -----END CERTIFICATE-----
Click on Add identity provider
Once your identity provider has been added, the fields Tomorro Callback URL and Tomorro Entity Identifier appear in the Tomorro configuration parameters section.
STEP 3 - Attributes
STEP 3 - Attributes
The Claim name of the Unique User Identifier (Name ID) should be the user.mail
Update the “source attribute” accordingly.
STEP 4 - Configure SAML settings for the app
STEP 4 - Configure SAML settings for the app
Select the single sign-on method SAML, and then start the configuration of the Basic SAML.
Connect to your Tomorro setup page as describe in the first part.
Copy the field Tomorro Callback URL and paste it to the fields Reply URL (Assertion Consumer Service URL) and Sign on URL of Azure.
Copy the field Tomorro Entity Identifier, and paste it to the field Identifier (Entity ID) of Azure.
Go to the section User of the Azure app and allow your users to use the app.
Don’t forget to click on “Update” after adding this data on Tomorro.
The SAML protocol is now activated for Tomorro !
💡 Without SCIM provisioning, each invited user must activate their account via the Tomorro invitation email before their first SAML SSO login. Until the account is activated, the login shows the message "SAML not enabled for this user". You can resend the invitation from Settings > Members ("Resend invitation"). To learn more: Sign in with SAML SSO.
If you have set up SCIM, this step does not apply: provisioned accounts are created already active and log in directly via SAML SSO.