Custom SAML 2.0 Connection

Last updated:

Use this guide for any identity provider that supports standards-based SAML 2.0 but is not covered by the Okta, OneLogin, or Microsoft Entra guides.

Before You Start

  • Identity-provider administrator access and support for an SP-initiated SAML 2.0 application.
  • An active Revspire Deal Room entitlement and access to Revspire > Setup > SSO .
  • View SSO Settings , View SAML SP Certificate , and Create SSO Providers permissions.
  • An active, licensed Revspire test user with a unique username or email.

Step 1: Copy Revspire SP Values

ACS URL = <copy from Revspire>
SP Entity ID / Metadata URL = <copy from Revspire>
SP Signing Certificate = <download or copy from Revspire>
SP Cert SHA256 Fingerprint = <copy from Revspire>

The metadata URL returns the Revspire SAML metadata. Do not register the Revspire SP Login URL as a generic start URL, and do not register the Revspire SP Logout URL as a SAML callback.

Step 2: Create the SAML Application

Import the Revspire metadata when your provider supports metadata import. Otherwise configure these values manually:

Protocol = SAML 2.0
ACS URL = <Revspire ACS URL>
ACS binding = HTTP-POST
Audience / SP Entity ID = <exact Revspire SP Entity ID>
Authentication flow = SP-initiated
Default RelayState = blank
Assertion encryption = disabled

Step 3: Configure Signing and Request Trust

SAML Response = signed
SAML Assertion = signed
Signature algorithm = RSA-SHA256
Digest algorithm = SHA-256
Assertions per response = exactly one

Revspire signs authentication requests. Configure the identity provider to trust the Revspire SP signing certificate when it supports signed-request verification. Revspire does not publish an assertion-encryption key, so encrypted assertions are unsupported.

Step 4: Configure Identity Claims

Use an immutable, non-reassigned identity-provider identifier as NameID. Also send at least one bootstrap claim that uniquely matches an existing Revspire user:

NameID = <stable immutable IdP user identifier>
NameID format = Unspecified or Persistent

Claim name = revspire_username
Claim value = <exact Revspire username>

Claim name = email
Claim value = <exact Revspire email>

Revspire does not create a user from the SAML assertion. On first login, a supported username or email claim must identify exactly one active, licensed user. Revspire then binds the provider-scoped NameID to that user.

Step 5: Copy Identity Provider Values

Issuer Entity ID = <exact IdP issuer>
SSO URL (IdP Login URL) = <HTTPS SAML SSO endpoint>
IdP SLO URL (Optional) = <HTTPS IdP logout endpoint, if supplied>
X.509 Certificate = <current IdP signing certificate in PEM format>

The certificate must include the PEM header and footer and must be currently valid. Confirm its SHA-256 fingerprint through a trusted channel.

Step 6: Add the Provider in Revspire

Path: Revspire > Setup > SSO > Add

Provider Type = Custom SAML 2.0
Provider Display Name = <recognizable provider name>
Issuer Entity ID = <exact IdP issuer>
SSO URL (IdP Login URL) = <HTTPS SAML SSO endpoint>
IdP SLO URL (Optional) = <HTTPS IdP logout endpoint, if supplied>
X.509 Certificate = <active IdP signing certificate in PEM format>
Set as Primary Provider = enabled for the controlled login test when this is not the first provider

The first provider becomes primary automatically. When multiple providers exist, only the primary provider handles normal Revspire-initiated login.

The issuer cannot be edited later because it identifies the trust relationship. Create a new provider if the issuer changes.

Step 7: Assign and Test

  1. Assign one pre-provisioned test user in the identity provider.
  2. Start at the Revspire login page, resolve the account, and choose Sign In with SSO .
  3. Confirm audience, issuer, signatures, identity binding, and logout.
  4. Test a second user and failure recovery before making the provider primary.
  5. Enable SSO-only only after validating an administrator recovery path.

Optional IdP Logout

If the identity provider exposes an HTTPS SAML logout endpoint, save that endpoint as IdP SLO URL (Optional) . Revspire always completes local logout first and may then send a best-effort LogoutRequest using the session’s NameID and SessionIndex. Revspire’s own SP Logout URL is not an inbound IdP callback.

Certificate Rollover

  1. Add the replacement IdP signing certificate to the existing Revspire provider before it becomes active.
  2. Verify its validity window and fingerprint.
  3. Switch the identity provider, test login, and only then deactivate the old certificate.

Troubleshooting

  • User not found or ambiguous: confirm a bootstrap claim identifies exactly one active, licensed Revspire user.
  • Invalid audience or destination: compare the exact SP Entity ID and ACS URL.
  • Signature validation: sign both response and assertion and confirm the current certificate.
  • Encrypted assertion: disable assertion encryption.
  • Unsolicited response: use SP-initiated login from Revspire; IdP-initiated SAML is disabled by default.

For lifecycle provisioning, continue with Custom SCIM 2.0 Provisioning.