Blog Details
Blog Post Actions
Related
Recommended

How to configure SAML SSO for Sugar

Matt Marum
1 minute read time
Many customers want to configure Sugar for Single Sign On (SSO). Well Sugar supports Security Assertion Markup Language (SAML) so this must be easy, right? But the devil is always in the details.

Each SAML identity provider behaves a little differently. Each of these systems has different terminology and methods for configuration and may use different default settings. Some of these important configuration settings can make the difference between a successful SSO implementation and a tire fire. For example, are users provisioned Just-In-Time or will they be provisioned manually? Did you know that Sugar uses the e-mail address as the SAML application username format?

Below are instructions for configuring SAML SSO with a couple of common identity providers.

Okta

One of our Solution Architects, Enrico Simonetti, wrote a good summary of how to configure SAML authentication for Sugar using Okta as the identity provider. Okta is convenient for trying out SSO because they have a developer program you can join. Enrico also covers a few tips and details that can trip up any SAML implementation.

Please visit Enrico's post called SSO Authentication on SugarCRM with SAML for more details including screen shots and even code examples.

Active Directory Federation Service

The most common system that we get questions about is Microsoft's Active Directory Federation Service (ADFS). ADFS is pretty complicated so there are several steps that you need to follow to get it done right.

We recently publish a SugarCRM Knowledge Base article called Configuring SSO With Active Directory's ADFS. It was written by Lars Blockken, one of our Senior Technical Account Managers, and in it he walks you through each of these steps in detail along with screenshots. It will have you up and running on ADFS in no time!

Parents

  • Comment originally made by Aaron Kerr.

    Is there any way for a single Sugar instance to support more than one SSO provider? We use SAML login with our current employees. However, we are looking at adding external vendors to our instance as well so they can participate on sales opportunities. These users are stored in a separate directory and would need to authenticate against a different SAML provider.

    I assume you would have to use different entry points/URLs for the user categories. I'm betting this isn't supported out of the box, but I'm wondering if it is a customization which has been done.

  • in reply to SugarCRM Developers

    Comment originally made by Matthew Marum.

    Hi Aaron,

    No way that you could synchronize these identities into a single IdP? It might make it all easier to manage.

    Out of the box we only support one SSO provider. You can completely override Sugar's authentication mechanism with any method of your choosing by creating a custom SugarAuthenticate class and setting $sugar_config['authenticationClass'] to this class name.  You can see examples of different Sugar authentication classes under modules/Users/authentication.

Comment
  • in reply to SugarCRM Developers

    Comment originally made by Matthew Marum.

    Hi Aaron,

    No way that you could synchronize these identities into a single IdP? It might make it all easier to manage.

    Out of the box we only support one SSO provider. You can completely override Sugar's authentication mechanism with any method of your choosing by creating a custom SugarAuthenticate class and setting $sugar_config['authenticationClass'] to this class name.  You can see examples of different Sugar authentication classes under modules/Users/authentication.

Children