We know how this is important to be SAML / SSO compatible for some companies.
Now you can use SAML 2.0 protocol to connect to Tomorro in the most secure way.
This allows you to bring in your favorite Identity provider and connect to Tomorro via SSO for the highest standard authentication.
✅ Best practices
The person who configures SAML SSO in Tomorro must have the Admin role (or Super admin): it is the only standard role that opens the SSO & Provisioning page and can save the configuration.
The configuration is in the settings, SSO & Provisioning section, SAML Authentication block.
If the person in your IT team who configures SAML SSO is not an admin, an admin can give them the Admin role for the duration of the configuration, then remove it; let your Tomorro account manager know (recommendation).
Connect on Tomorro
In order to set up the integration, please go to the integration setup page on Tomorro and open the section Authentication SAML to start the setup. Only admins have access to this section.
💡 If your organisation has moved to the new SSO, the SAML Authentication section also shows Identity providers on the new SSO. You manage your identity providers yourself: Add identity provider, then Edit, Delete or Set as default. Each provider is configured with a Name, an Email domain, an Issuer, an Entrypoint and an x509 Certificate ; the email domain determines which users are directed to that provider. You can register up to three identity providers in total. Availability depends on your organisation's plan ; to get access, contact your account manager.
Setup on OneLogin
STEP 1 - Create a custom app on OneLogin
STEP 1 - Create a custom app on OneLogin
In your administrator area, go to the "Applications" section, then click on "Add App" at the top right of the page
Enter the application name, for example "Tomorro", add a logo and icon, then save
Go to configuration tab
Find “SAML signature element”
Set it to “Both”
Save your changes
STEP 2 - Configure SAML settings for the app
STEP 2 - Configure SAML settings for the app
Log in to your Tomorro setup page as described in the first part.
Copy the Tomorro Callback URL and paste it in ACS (Consumer) URL Validator and ACS (Consumer) URL on OneLogin
Copy the Tomorro Entity Identifier and paste it in Audience (EntityID) on OneLogin
On Tomorro (copy) :
On OneLogin (paste) :
STEP 3 - Activate SAML SSO
STEP 3 - Activate SAML SSO
Go the section SSO of the OneLogin app
Copy Issuer URL and paste it on Issuer on Tomorro.
Copy SAML 2.0 Endpoint (HTTP) and paste it on Entry Point on Tomorro
Copy X.509 Certificate and paste it on x509 Certificate on Tomorro
Don’t forget to click on “Update” after adding this data on Tomorro.
Go to the section User of the OneLogin app and allow your users to use the app.
The SAML protocol is now activated for Tomorro !
💡 Without SCIM provisioning, each invited user must activate their account via the Tomorro invitation email before their first SAML SSO login. Until the account is activated, the login shows the message "SAML not enabled for this user". You can resend the invitation from Settings > Members ("Resend invitation"). To learn more: Sign in with SAML SSO.
If you have set up SCIM, this step does not apply: provisioned accounts are created already active and log in directly via SAML SSO.