We know how this is important to be SAML / SSO compatible for some companies.
Now you can use SAML 2.0 protocol to connect to Tomorro in the most secure way.
This allows you to bring in your favourite Identity provider and connect to Tomorro via SSO for the highest standard authentication.
Connect on Tomorro
In order to set up the integration, please go to the integration setup page on Tomorro and open the section SAML Authentication to start the setup. Only admins have access to this section.
💡 If your organisation has moved to the new SSO, the SAML Authentication section also shows Identity providers on the new SSO. You manage your identity providers yourself: Add identity provider, then Edit, Delete or Set as default. Each provider is configured with a Name, an Email domain, an Issuer, an Entrypoint and an x509 Certificate ; the email domain determines which users are directed to that provider. You can register up to three identity providers in total. Availability depends on your organisation's plan ; to get access, contact your account manager.
Setup on Okta
STEP 1 - Create a custom app on OKTA
STEP 1 - Create a custom app on OKTA
Connect to your “OKTA account > Settings > Application”
Then click on Create App Integration > SAML 2.0
STEP 2 - Configure SAML settings for the app
STEP 2 - Configure SAML settings for the app
Connect to your Tomorro setup page as describe in the first part.
Copy the Tomorro Callback URL and paste it in Single Sign On URL on Okta.
Copy the Tomorro Entity Identifier and paste it in Audience URI on Okta
Click on Next and confirm the App creation, by selecting the following options :
“I’m an Okta customer adding an internal app”
“This is an internal that we have created”
After creating the app, assign yourself to the app so you can access it.
STEP 3 - Activate SAML SSO
STEP 3 - Activate SAML SSO
From the App interface on Okta, click on “View SAML setup instructions”.
Copy Identity Provider Issuer and paste it in Issuer on Tomorro.
Copy Identity Provider Single Sign-On URL and paste it in Entry Point on Tomorro
Copy X.509 Certificate and paste it in x509 Certificate on Tomorro
Don’t forget to click on “Update” after adding this data on Tomorro.
Go to the section User of the Okta app and allow your users to use the app.
The SAML protocol is now activated for Tomorro !
💡 Without SCIM provisioning, each invited user must activate their account via the Tomorro invitation email before their first SAML SSO login. Until the account is activated, the login shows the message "SAML not enabled for this user". You can resend the invitation from Settings > Members ("Resend invitation"). To learn more: Sign in with SAML SSO.
If you have set up SCIM, this step does not apply: provisioned accounts are created already active and log in directly via SAML SSO.