SAML Single Sign-On

SSO offers a user-friendly approach to log into multiple applications or platforms using a single set of credentials. This document outlines our company's guidlines for SSO integration.

To enable this feature, you must have a teams account and hold the owner role.

Once enabled, All members will be able to log in using your identity provider. Additionally, any new users opting for SAML authentication will seamlessly integrate into your organization, streamlining the onboarding process.

How It Works

1. The user can use either of these methods:
   • Member attempt to log in to Wave Connect (Wave) by entering his/her email address.
   • The user attempts to login by clicking on the SSO button and entering the organization username (this can be found and configured under your organization settings on Teams by Wave Connect).
2. Wave Connect sends a request to the identity provider.
3. The identity provider checks this member's credentials.
4. The identity provider sends a response to Wave to verify the member's identity.
5. Wave accepts the response and logs the member into their Wave account.
   

SAML - What We Need

To integrate with our system, we will need the following:

1. The provider's Entity ID: A name that identifies the identity provider.
2. The provider's SSO URL: The URL of the identity provider's sign-in page.
3. The service provider Entity ID: A name that identifies the service provider.
4. The provider's public key certificate: The certificate used to validate tokens signed by the identity provider.

SAML - What You Will Need

To link our authentication system to your SSO, you will need to add the following call-back URL into your SAML application configuration: https://app.wavecnct.com/\_\_/auth/handler

Enforcing SAML

Once your SAML SSO integration has been configured and tested, organization owners can enforce SAML SSO across the organization.

When SAML enforcement is enabled:

• Mandatory IdP Authentication: All organization members must authenticate exclusively using your identity provider.
• Disabled Password & Social Logins: Standard password login and third-party social logins (such as Google or Apple) will be disabled for members under your organization's domain.
• Automatic Member Provisioning: New users authenticated via SAML will automatically be added to your organization under their corporate identity.

How to Enforce SAML:

1. Sign in to Wave for Teams (opens in a new tab) with an Owner account.
2. Navigate to Organization Settings > Security > SAML Single Sign-On.
3. Toggle the Enforce SAML SSO switch to Enabled.
4. Click Save Changes.

Use the Custom Login Page

Wave provides a dedicated custom login page and direct login URL for your organization to streamline member access:

1. Find Your Organization Identifier:

   • Go to Organization Settings in Wave for Teams (opens in a new tab).
   • Under your organization profile, locate your unique Organization Username / Slug.

2. Direct SSO Login URL:

   • Share your organization-specific login URL with your team:

     https://app.wavecnct.com/login?org=<your-organization-username>
   • When users visit this link, they are automatically prompted to sign in with your corporate identity provider without having to manually enter an organization slug.

3. SP-Initiated Sign-In via Standard Login Page:

   • Alternatively, members can go to the standard login page at app.wavecnct.com/login (opens in a new tab), click Log in with SSO, and enter your organization username to be redirected to your identity provider.