# Configure Single-Sign On (SSO) for Sanas App/ Portal

- Updated on Apr 7, 2026
- Published on Apr 2, 2026

- 3 minute(s) read

### Introduction

Configure Single Sign-On (SSO) to allow users to authenticate on the Sanas Portal and the Sanas App using your organization's existing Identity Provider (IdP). Sanas uses the SAML 2.0 protocol to integrate with your IdP for authentication and access validation.

### How it works

SSO follows the following workflow to authenticate users:

1. The user navigates to the Sanas Portal or App.

2. User authentication:
   - **Sanas Portal**: User selects the SSO option on the login screen to initiate authentication.
   - **Sanas App**: User gets automatically redirected for authentication upon the Sanas App launch.

3. The user is redirected to the organization's IdP and follows the on-screen instructions to complete authentication.

4. Upon successful verification, the user is redirected back to Sanas with authorized access.

> _Note: The user must exist on the integrated IdP._

#### Automatic User Creation

Automatic User Creation is an additional feature that works alongside Auto-Activation and SSO to eliminate the requirement of manually adding users to the Portal.

When Automatic User Creation is enabled, Sanas checks whether the user exists on the Portal and acts accordingly:

- **If the user exists**, the user is granted access to the Sanas App.
- **If the user does not exist**, a new user account is created on the Portal, and the user is granted access to the Sanas App.

Newly created users are mapped to a Group based on the Installer ID configured on their computer. Installer IDs are unique Group identifiers found on each group's **Get Sanas** page. There are two types:

- **Group Installer ID** — New users are added to the specific group associated with this ID.
- **Account Installer ID** — New users are added to the Default Group.

### Before you begin

- For Portal configuration, ensure your Portal role has **Group Settings** and **Account Settings: Full access**.
- If configuring SSO for Sanas App users, ensure the Installer ID has been updated on each user's machine during app installation. If not, see [Update Installer ID](https://help.sanas.ai/portalv3/docs/update-installer-id-on-the-sanas-app-user-s-computer) for instructions.
- Ensure Auto-provisioning is enabled on the intended groups. Navigate to **Settings** > **Configuration** > **Application Authentication** > Ensure **SSO or Auto-activation** is configured > Ensure the **Automatic User Creation** toggle is enabled.
- Ensure you have administrative privileges on your IdP platform to complete the integration.
- Ensure all intended users are added to the IdP before enabling SSO.
- Ensure all intended Portal users are added to the Sanas Portal before enabling SSO. See [Manage Portal Users](https://help.sanas.ai/portalv3/docs/invite-portal-admins#invite-portal-users) for instructions.

### Configure SSO

Follow the steps below to configure SSO:

**Step 1: Gather integration details from the Sanas Portal**

1. Log in to the Sanas Portal with your credentials.
2. Navigate to **Settings > Configuration > SSO Settings**.
3. Click **Add SSO Provider**.
4. Enter your IdP name.
5. Copy the following details and save them securely:
   - **Identifier**
   - **Reply URL**

**Step 2: Complete the SAML 2.0 integration on your IdP**

1. Configure the SAML integration on your IdP platform using the **Identifier** and **Reply URL** copied in Step 1.
2. Map the following attributes during the SSO configuration:

| Attribute   | Value                     | Description                     |
|-------------|--------------------------|---------------------------------|
| `username`  | UserID or Email          | Unique identifier for the user. |
| `name`      | User name                | Display name for the user.      |

3. Once the integration is complete, download or copy the X-509 certificate metadata from your IdP. You'll need this to finalize the configuration on the Sanas Portal.

**Step 3: Complete the SSO configuration on the Sanas Portal**

1. If you downloaded the X-509 certificate as a file, open it in a text editor and copy its content.
2. Return to the SSO Settings page on the Sanas Portal and paste the certificate content.
3. Click **Save**.
4. _(Optional)_ Enable the **Lock Configuration** toggle to prevent subgroups from modifying the SSO provider integration.

**Step 4: Configure the authentication mode**

After integrating the IdP, set SSO as the authentication mode for the Sanas App user or Portal user:
1. Select a group on the Group Tree for which you want to enable SSO authentication.
2. Navigate to **Settings > Configuration > Application Authentication** or **Portal Authentication**.
3. Select **SSO** or your configured IdP from the list.
4. Click **Save** to apply the changes.
5. Ensure the **Automatic User Creation** toggle is enabled.

## Support

**Need help?** Get in touch with our Support Team for assistance.