Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

Single Sign-On

Connect your SAML 2.0 identity provider so people sign in to DeviceQuest with their company account, and test, refresh, disable or remove the connection.

Overview

The Single Sign-On page connects DeviceQuest to your SAML 2.0 identity provider (IdP), so people sign in with their company account instead of a DeviceQuest password. Each tenant has one SAML identity source. Use this page to configure it, check that the IdP is reachable, refresh the IdP’s metadata, follow SSO sign-ins and changes, and turn SSO off or remove it. Open it from Admin → SSO (/admin/security/sso).

Permissions:

  • sso:read (or admin:manage) opens the page, the detail tabs and the SSO audit trail.
  • sso:write (or admin:manage) runs a connection test, refreshes metadata and deletes the configuration.
  • admin:manage saves the configuration and disables SSO.

Screen tour

  1. Test and Refresh: run a connection test or refresh the IdP metadata. When no identity source exists yet, this place shows Configure SAML 2.0 instead.
  2. Health bar: the provider (SAML 2.0), Enabled or Disabled, and when the metadata was last fetched, for example Metadata: 3d ago. Refresh recommended appears when the metadata is more than 180 days old. Without a configuration, the bar shows Not configured and Configure SAML.
  3. Activity: a sentence such as SAML SSO is enabled. 4 successful logins in the last 14 days, 1 failed. Metadata last refreshed 2d ago., with a chart of SSO logins / day (14 days). Click the logins to open the Sessions tab, the failures to open the audit trail filtered to failed logins, and the refresh time to open the audit trail. A line such as N new SSO events since your last visit appears when something happened since you last opened the page.
  4. View full audit →: opens the Audit tab of the identity source.
  5. Identity Sources: the configured SAML 2.0 source with its status.
  6. Copy: copies the Entity ID shown on the card.
  7. View details →: opens the identity source details. Clicking the card does the same.
  8. Test, Edit and More actions (⋮): test the connection, open the configuration wizard, or open the menu with Refresh metadata, Disable SSO (or Re-enable SSO) and Delete configuration.
  9. Status and Quick Actions: Enabled or Disabled (with Active while SSO is on), and shortcuts to Test Connection, Refresh Metadata and View Audit Log.
  10. Certificate: the start of the IdP signing certificate’s fingerprint.

On narrow screens the status and quick actions move into a Quick info & actions section below the identity source.

Supported identity providers

DeviceQuest works with any identity provider that supports SAML 2.0 with the HTTP-POST binding, for example:

  • Okta
  • Microsoft Entra ID (Azure AD)
  • Google Workspace
  • OneLogin
  • Active Directory Federation Services (ADFS)
  • Auth0
  • JumpCloud

In your IdP, create a SAML application for DeviceQuest with these service provider (SP) values. You find them on the Overview tab of the identity source once you have saved a configuration:

IdP settingDeviceQuest value
Assertion Consumer Service (ACS) / Reply URLACS URL, https://<your DeviceQuest address>/saml/acs/<tenant ID>
SP metadataSP metadata URL, /saml/metadata/<tenant ID> on your DeviceQuest address
SP-initiated sign-in URLSP login URL, /saml/login/<tenant ID> on your DeviceQuest address
Audience / SP Entity IDThe Entity ID you enter in the wizard
Name IDThe user’s email address

Send the user’s email address as the Name ID or as an email attribute, and the display name as displayName or name. If your IdP uses other attribute names, map them with Attribute mapping.

Configure SAML

  1. Click Configure SAML 2.0 (or Edit on an existing identity source). The wizard opens: Configure SAML 2.0 for a new source, Edit SAML configuration for an existing one.
  2. Fill in Provider details and click Next: Test connection.
  3. Run the test and click Next: Review.
  4. Check the summary, set Enable SSO for this tenant, and click Save and enable (or Save).

Step 1: Provider details

  1. Steps: Provider details, Test connection and Review & save.
  2. Entity ID: the service provider Entity ID registered for DeviceQuest in your IdP. Required.
  3. Metadata URL: the IdP metadata address. Recommended: DeviceQuest reads the IdP’s settings and certificate from it and can refresh them later. Must be HTTPS.
  4. SSO URL (manual): the IdP’s sign-in endpoint. Required when you don’t give a Metadata URL.
  5. SLS URL (optional): the IdP’s single logout endpoint.
  6. Certificate PEM (optional): the IdP signing certificate. Paste it when you don’t use a Metadata URL.
  7. Attribute mapping (JSON, optional): a JSON object that maps DeviceQuest fields to the attribute names your IdP sends, for example {"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"}.
  8. Next: Test connection: available once Entity ID and either Metadata URL or SSO URL (manual) are filled in. Cancel closes the wizard without saving.

Step 2: Test connection

Click Run test to check the settings before you save them. The test checks that the Entity ID is present, the Metadata URL is reachable, and a pasted certificate parses.

  1. Run test / Re-test: runs the checks again after you change something.
  2. Result: All checks passed or Some checks failed, with the time the test took and the certificate fingerprint when a certificate was checked.
  3. Checks, each marked passed (✓), failed (✗) or Not run (–) with a message.
  4. Next: Review: continues. You can save even when a check failed.

The test runs these checks:

CheckPasses whenNot run when
Entity ID presentThe Entity ID is filled in.—
Metadata URL reachableDeviceQuest fetches the Metadata URL and gets HTTP 200. A failure shows the error or HTTP status.No Metadata URL was given.
Certificate parsesThe pasted Certificate PEM is a valid certificate; its fingerprint is shown.No certificate was pasted.

Step 3: Review & save

  1. Summary of the Entity ID, Metadata URL, SSO URL, SLS URL and whether a Certificate was Provided (PEM).
  2. Enable SSO for this tenant: on by default. Turn it off to save the configuration without enabling SSO yet.
  3. Back: returns to the previous step.
  4. Save and enable (or Save when the switch is off): saves the configuration. When the test reported failures the button reads Save anyway, and a warning reminds you that saving does not re-run the test.

After saving, a toast confirms SSO configured successfully. and the identity source details open. If saving fails, the error shows in the wizard with Try again.

When SSO is enabled, people sign in with Sign in with SSO on the sign-in page, entering your organization ID (see Signing in). People who sign in through SSO for the first time get a DeviceQuest account automatically (just-in-time provisioning); give them roles on the Users and invitations page.

Identity source details

Click View details → or the identity source card to open the details side panel. The same details are also available as a full page at /admin/security/sso/saml, with Back to SSO to return.

  1. Status (Enabled or Disabled) and when the configuration was last updated.
  2. Actions: Test connection, Refresh metadata, Edit, Disable (or Re-enable) and Delete.
  3. Tabs: Overview, Identity Provider, Sessions and Audit.
  4. ACS URL: the address your IdP posts sign-in responses to. Click the copy icon next to any value to copy it.
  5. Refresh: refreshes the IdP metadata from the Metadata URL.
  6. SP metadata URL: the DeviceQuest service provider metadata, to import into your IdP.
  7. SP login URL: the address that starts an SSO sign-in for your tenant.

Overview tab

Lists Status, Provider type, Entity ID, ACS URL, SLS URL (when set), Metadata URL with Refresh, Certificate fingerprint (with Refresh recommended when the metadata is more than 180 days old), Metadata last fetched, Created, Last updated, SP metadata URL and SP login URL.

Identity Provider tab

A read-only protocol summary. To change values, click Edit in the panel header.

  1. Test connection: runs the connection test against the saved configuration.
  2. Endpoints: Provider, Entity ID, SSO endpoint, SLS endpoint (or Not configured) and ACS URL.
  3. Binding: HTTP-POST (SAML 2.0), and Replay protection, which rejects a sign-in response that is used twice.
  4. JIT provisioning: explains that people who authenticate through SSO for the first time get an account automatically.

When you saved an Attribute mapping, an Attribute mapping section lists each DeviceQuest field and the IdP attribute it reads.

Sessions tab

The Sessions tab lists the active SAML sessions in your tenant: who signed in through SSO, when, and from which IP address. Use it to see who currently uses SSO, for example before you disable it. The N successful logins link in the Activity sentence opens this tab.

Audit tab

The Audit tab lists SSO events, newest first: configuration changes and every SSO sign-in.

  1. Action filter: All, Configured, Disabled, Deleted, Metadata refreshed, Login success and Login failed.
  2. Period: Last 7 days, Last 30 days, Last 90 days or All time.
  3. Search events…: filters the loaded events by action, actor email or details.
  4. Export CSV: downloads the events shown, as sso-audit-<date>.csv with Timestamp, Action, Actor User ID, Actor Email, IP Address and Details.

Each event shows the actor (or System), the action, the IP address and when it happened. Click Show details to see the recorded details, and Load more for older events. With no events the tab shows No SSO events recorded yet.; when filters hide everything, Clear filters resets them.

Test the connection

  1. Click Test in the page header, on the identity source card, or Test connection in the details.
  2. The Test connection dialog runs the checks against the saved configuration straight away and shows the result as in the wizard.
  3. Click Re-test to run it again, or Close.

Refresh the metadata

Refresh the metadata after your IdP rotates its signing certificate or changes its endpoints.

  1. Click Refresh in the page header, Refresh metadata in the More actions menu or the details, or Refresh next to the Metadata URL.
  2. Read Refresh IdP metadata?: the stored certificate and URLs are replaced with what the IdP currently returns. Active sessions are unaffected. The metadata URL must be reachable from the server, and only HTTPS metadata URLs are accepted.
  3. Click Refresh metadata.

A toast confirms IdP metadata refreshed. If the IdP cannot be reached, nothing is changed.

  1. Refresh metadata: fetches the IdP metadata again.
  2. Disable SSO: turns SSO off; reads Re-enable SSO while SSO is disabled.
  3. Delete configuration: removes the SAML configuration.

Disable or re-enable SSO

  1. Click Disable SSO in the More actions menu, or Disable in the details.
  2. Read Disable SSO?: users fall back to password login, and existing SSO sessions remain valid until they expire. This is reversible.
  3. Click Disable SSO.

A toast confirms SSO disabled. The configuration is kept, so you can switch SSO back on: click Re-enable SSO (or Re-enable) and confirm in Re-enable SSO?.

Delete the configuration

Deleting removes the IdP certificate and all SSO URLs. To use SSO again you redo the full pairing with your IdP.

  1. Click Delete configuration in the More actions menu, or Delete in the details.
  2. Type DELETE in the confirmation field.
  3. Click Delete permanently.

  1. Warning: This permanently removes the IdP certificate and all SSO URLs.
  2. Type DELETE to confirm: the button stays disabled until you type DELETE.
  3. Delete permanently: deletes the configuration. Cancel keeps it.

A toast confirms SSO configuration deleted. and the page returns to the empty state, No identity source configured yet, with Configure SAML 2.0.

Fields

FieldDescriptionRules
Entity IDService provider Entity ID registered for DeviceQuest in your IdP.Required.
Metadata URLWhere DeviceQuest reads the IdP metadata.HTTPS. Required unless SSO URL (manual) is set. Needed for Refresh metadata.
SSO URL (manual)IdP sign-in endpoint.Required unless Metadata URL is set.
SLS URL (optional)IdP single logout endpoint.Optional.
Certificate PEM (optional)IdP signing certificate.PEM format, -----BEGIN CERTIFICATE----- … -----END CERTIFICATE-----. Use when there is no Metadata URL.
Attribute mapping (JSON, optional)Maps DeviceQuest fields such as email and displayName to your IdP’s attribute names.A JSON object with string values.
Enable SSO for this tenantWhether SSO is active after saving.On by default.

Statuses

StatusMeaningNext possible status
Not configuredNo SAML identity source exists. People sign in with passwords.Enabled or Disabled (after you save the wizard)
EnabledPeople can sign in through your IdP.Disabled, Not configured (after delete)
DisabledThe configuration is kept, but SSO sign-in is off and people use passwords.Enabled, Not configured (after delete)
Refresh recommendedShown next to an enabled or disabled source when the metadata was last fetched more than 180 days ago.Cleared by Refresh metadata

Keyboard shortcuts

KeyAction
cOpen the configuration wizard.
tTest the connection.
rRefresh the metadata.
dDisable (or re-enable) SSO.
Shift+DDelete the configuration.
g then oOpen the Overview tab.
g then pOpen the Identity Provider tab.
g then sOpen the Sessions tab.
g then aOpen the Audit tab.
EscClose the open dialog, then the details panel.

The shortcuts work when no text field has focus.