The SAML integration for Teamgage allows your employees to log in seamlessly using Single Sign-On (SSO). With SSO, users can access Teamgage with one click, using their existing work credentials.

Setup Process

Configuring your Teamgage account for SSO proceeds in two phases:

• User Acceptance Test: connect your SAML identity provider to the Teamgage UAT environment. https://uat.teamgage.com/
• Production launch: connect to Teamgage production and scheduled cut-over for existing users. https://www.teamgage.com/

Each phase consists of the following steps:

1. IdP configuration: Your IT staff configure your Identity Provider with the Teamgage settings
2. SSO setup request: You provide Teamgage with the required information:
   
   • Email domains used within your organisation (through this identity provider)
   • Your SAML IdP metadata URL
3. SP configuration: Teamgage configures your organisation for SSO and performs cut-over.
4. Validation: You and Teamgage test for successful login using SSO.
   

Configuration Guides

Step-by-step configuration guides are available for the following platforms:

• Okta - with App integration (type Teamgage into the search box)
• Active Directory Federation Services (ADFS) 

Other SAML 2.0 Identity Providers can be set up using the configuration details below.

Configuration Details

To connect to Teamgage, configure a new SAML 2.0 Application (or SP/Relying Party) in your Identity Provider as follows:

Metadata URL

• UAT: https://uat.teamgage.com/Saml2
• Production: https://www.teamgage.com/Saml2
  Recommended: Enable "Automatic update"/polling.

Attributes

• NameID (some providers require this to be added explicitly)
• Email:
  
  • Attribute Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailidentifier
  • Attribute Name Format: URI Format
  • Value: User email address

Manual Configuration

If you need to provide manual SAML SP configuration, the following additional details may be useful. This is also encoded in the metadata file (URL linked above).

Important: Manual configurations will require you to manually reconfigure the signing certificate from time to time. Please contact support to ensure that you are notified when we rotate to a new certificate.

Additional Information

1. Teamgage currently supports the Web Browser SSO Profile with SP Redirect Request and IdP POST Response
   

1. Teamgage supports both SP-initiated and IdP-initiated SSO
   

1. The NameID value must be sufficiently unique to the user and no longer than 128 characters
2. We recommend using the user's object GUID; if this is not possible then the username or email could be used
3. The NameID format is unspecified, and will behave correctly with both persistent and transient semantics. Each new NameID received is associated to a user account using the email attribute, and will be reused for subsequent requests
   

1. SP (Teamgage) certificate
   
1. When our existing signing certificate is approaching expiry, a new certificate will be generated and published in our metadata (alongside the existing certificate)
2. We will switch to signing with this certificate no earlier than 1 month after it is published to our metadata
3. If you have configured your IdP using the metadata URL with polling (at least once a month) then this rotation will occur automatically
4. If you have performed manual configuration, please contact support to ensure that you are notified when we rotate to a new certificate
   
2. IdP (Customer) certificate
   
1. We will periodically poll your application's metadata URL, and will trust authorisation responses signed by any signing certificate listed in this metadata
2. Please ensure new certificates are included in your metadata at least 1 week before it is used for signing, and that the old certificate is also included until it is no longer being used for signing
3. If you are not able to publish the new certificate in advance, please contact support to schedule a manual certificate update