Set Up Single Sign-On with Your Identity Provider

You can connect BEAMON to your organisation's identity provider (IdP) so that users sign in with their existing company credentials via single sign-on (SSO). BEAMON supports any standard IdP, such as Okta, Entrust or PingFederate, using either OIDC or SAML 2.0.

Behind the scenes, BEAMON uses Amazon Cognito. Your organisation gets its own dedicated user pool, which we configure together with you.

Set Up SSO with OIDC

1. Contact us: Write to help@beamon.ai to start the setup. Let us know which IdP you use and whether you have any specific requirements.
2. Receive the callback URL: We'll send you the callback URL for your user pool. Enter it exactly as provided when you register BEAMON as an application in your IdP.

3. Send us your IdP details:

   • Provider name: The name users will see on the BEAMON login page.
   • Client ID: The ID your IdP assigns when you register BEAMON as an application.
   • Client secret: The secret your IdP generates for this application. Please share it through a secure channel.
   • Issuer URL: The URL where your IdP publishes its configuration. In most cases, this is enough for us to retrieve all other endpoints automatically.
   • Attribute request method (GET or POST): The HTTP method used to request user details from your IdP's userInfo endpoint.

   If your IdP doesn't support automatic discovery, we'll also need the following endpoints:

   • Authorization endpoint: Where users are redirected to sign in.
   • Token endpoint: Where authorisation codes are exchanged for tokens.
   • UserInfo endpoint: Where user information is retrieved after sign-in.
   • JWKS URI: Where the keys for validating tokens are published.
4. Agree on attribute mapping: BEAMON requires two attributes:
   • Email address: Used to identify users. Must be a valid email address.
   • Full name: Shown in the BEAMON interface.
5. Test the connection: Once everything is configured, we'll check the setup with you and may ask you to sign in with a test user.

Set Up SSO with SAML 2.0

1. Contact us: Write to help@beamon.ai to start the setup. Let us know which IdP you use and whether you have any specific requirements.
2. Receive the ACS URL and Entity ID: We'll send you the ACS URL (Assertion Consumer Service URL) and the Audience URI (Entity ID) for your user pool.
3. Configure your IdP: Create a SAML application for BEAMON in your IdP and enter these two values. For background on the Amazon Cognito side, see Amazon Cognito's documentation.
4. Send us your IdP metadata: Share your IdP's metadata as an XML file or metadata URL. It usually contains your IdP's entity ID, sign-in URL and signing certificate.
5. Agree on attribute mapping: BEAMON requires the email address and full name. Let us know which attributes in your IdP contain these values.
6. Test the connection: Once we've received the metadata and attribute mapping, we'll complete the setup and may ask you to sign in with a test user.

Next Steps

We'll guide you through the remaining steps until SSO is up and running. If you have any questions along the way, contact help@beamon.ai.

Frequently Asked Questions