OneLogin
As a Capacity Admin user, you can configure SAML 2.0 single sign-on (SSO) using OneLogin as your identity provider. This article walks you through configuring OneLogin as your identity provider (IdP), what to share with Capacity to complete setup, and what your users will see once SSO is enabled.
How it Works
In this configuration, Capacity is the service provider (SP) and OneLogin is the identity provider (IdP). You'll create a new SAML application in OneLogin, configure it with the SAML values Capacity requires, and then share your IdP metadata with Capacity so we can complete the connection on our end.
Before you begin
Before you can configure SAML 2.0 SSO in OneLogin, you'll need:
- An admin account within your CI environment.
- A super admin user within OneLogin to create and configure SSO applications.
Configure OneLogin
Add SAML App
- Sign in to your OneLogin Administration console.
- Go to Applications >> Applications.
- Select Add App.
- Search for SAML Custom Connector (Advanced) and select it from the results.
- Enter a Display Name (we recommend Capacity Conversation Intelligence).
- Select Save.
Complete Basic SAML Configuration
OneLogin's default SAML signing algorithm (SHA-1) does not meet Capacity's encryption requirements. You must change it to SHA-512.
- On the SSO tab, set SAML Signature Algorithm to SHA-512.
- Select Save.
- On the Configuration tab, enter the values below:
| Field | Value |
|---|---|
| Audience (EntityID) | https://{your-environment-url}/AuthServices |
| ACS (Consumer) URL Validator | * |
| ACS (Consumer) URL | https://{your-environment-url}/AuthServices/Acs |
Replace the placeholder with your own Capacity environment URL — e.g. mycompany.tethr.com)
- On the Parameters tab, select the +button to add a new field.
- Enter
user.idas the Field Name, check Include in SAML assertion.
- Enter
- Selec Save.
- On the next screen, set the Field Value to Email and save.
Download Metadata
From the application's More Actions menu, select SAML Metadata to download an XML file of your SAML metadata. This tells Capacity how to communicate with OneLogin and request authentication.
Assign users
On the application's Users tab, assign everyone who should sign in to Capacity using SSO.
Account Activation and Sign-In Experience
When a Capacity user needs to be activated and they're using SSO, they should use the Sign in with OneLogin button rather than the Activate account button. Once SSO is enabled for your organization, your users' login page will include this option alongside standard sign-in.
What to Share with Capacity
| Item | Description |
|---|---|
| IdP metadata (XML) | The metadata file downloaded in step Download Metadata |
| Sign-in button label preference (Optional) | Optional. Defaults to "Sign in with OneLogin" unless you request otherwise. |
Always share credentials and metadata files securely — never as plain text in an email