SAML SSO with Other Identity Providers

Connect Cube to any SAML 2.0 identity provider, such as JumpCloud, OneLogin, or a custom IdP, using the same configuration Cube uses for Okta and Azure.

Required permission: Admin. This permission is available to Admin users by default. You’ll also need administrator access to your identity provider to complete the steps on that side.

Note: This guide covers providers without a dedicated Cube article. If you use Okta or Azure (Microsoft Entra), use those providers’ dedicated setup articles instead, since they include provider-specific screens.

Steps

1. Request an ACS URL from the Cube support team.

Note: Cube provides a unique ACS URL per account. You’ll enter this in your identity provider in step four.

2. In your identity provider’s admin console, create a new SAML 2.0 application for Cube.
3. Choose, download, or copy the following items from your identity provider; you’ll send these to Cube support.
   • Identity Provider Issuer (also called Entity ID or Issuer)
   • Identity Provider Single Sign-On URL (also called SSO URL or SAML Endpoint)
   • x.509 Certificate (base 64 version)

Note: Send the certificate to Cube using One Time Secret rather than email or chat.

4. Enter the following values in the Service Provider section of your identity provider.
   • Entity ID: https://portal.cubesoftware.com/users/auth/sso/saml/metadata
   • ACS URL: the company-specific URL Cube sent you in step one
5. In the Attribute Statements section, add each of the following claims, matching the name exactly.
   • User.FirstName
   • User.LastName
   • User.EmailAddress

Note: Claim names are case sensitive. Clear the Namespace field for every claim. Identity providers often add a http://schemas... namespace by default, and a populated namespace causes the claim to fail.

6. Map each claim to the corresponding user attribute in your identity provider, such as first name, last name, and email address.

   Example mappings

   Claim name	Okta user attribute
   User.FirstName	user.givenname
   User.LastName	user.surname
   User.EmailAddress	user.userprincipalname
   emailaddress	user.mail

    

7. Save the application in your identity provider.
8. Send the Identity Provider Issuer, Single Sign-On URL, and certificate to Cube support.
9. Once Cube support confirms your SAML integration is active, sign in with your identity provider to confirm users can authenticate.

Related articles

• Okta with SAML SSO
• Azure (now Microsoft Entra) with SAML SSO
• Google with SAML
• Configure Custom Attribute Claims for Okta SAML SSO
• Duo SAML SSO