{"id":28670,"date":"2026-06-17T15:47:34","date_gmt":"2026-06-17T15:47:34","guid":{"rendered":"https:\/\/refiner.io\/docs\/?post_type=knowledgebase&#038;p=28670"},"modified":"2026-06-17T16:05:24","modified_gmt":"2026-06-17T16:05:24","slug":"set-up-saml-sso","status":"publish","type":"knowledgebase","link":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/","title":{"rendered":"Set up SAML SSO"},"content":{"rendered":"\n\n\n<p>Refiner supports authentication through SAML Single Sign-On. SAML SSO allows your organization to manage user access to Refiner through your Identity Provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, or another SAML-compatible provider.<\/p>\n\n\n\n<p>Setting up SAML SSO for Refiner is currently a manual process. It requires coordination between your Refiner account team and your organization\u2019s Identity Provider administrator.<\/p>\n\n\n\n<p>SAML SSO is included in Refiner Enterprise plans. For customers on Essentials and Growth plans, SAML SSO can be enabled for a one-time setup fee.<\/p>\n\n\n\n<p>Once SAML SSO is enabled, your organization can control which users have access to Refiner directly from your Identity Provider. Authentication is handled by your Identity Provider, while Refiner receives the user information required to create and manage user accounts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Contact us<\/h2>\n\n\n\n<p><a href=\"https:\/\/refiner.io\/docs\/kb\/getting-started\/contact-support\/\">Contact the Refiner team<\/a> and let us know that you would like to enable SAML SSO for your account.<\/p>\n\n\n\n<p>We will prepare your Refiner account for SAML authentication and send you the Service Provider details required to configure Refiner in your Identity Provider.<\/p>\n\n\n\n<p>This information includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ACS URL<\/li>\n\n\n\n<li>Login URL<\/li>\n\n\n\n<li>Logout URL<\/li>\n\n\n\n<li>Metadata URL<\/li>\n\n\n\n<li>SLS URL<\/li>\n\n\n\n<li>Entity ID<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Add Refiner to Identity Provider<\/h2>\n\n\n\n<p>In your Identity Provider, add Refiner as a new SAML application.<\/p>\n\n\n\n<p>Use the Service Provider information provided by the Refiner team to configure the application. If Refiner is not available as a preconfigured application in your Identity Provider, you can add it as a custom SAML application.<\/p>\n\n\n\n<p>The exact setup process depends on your Identity Provider. In most cases, you will need to enter the ACS URL, Entity ID, and other SAML endpoints provided by Refiner.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Send us your metadata<\/h2>\n\n\n\n<p>After creating the SAML application in your Identity Provider, your provider will generate a metadata XML file or a metadata URL.<\/p>\n\n\n\n<p>Please send this metadata XML file or URL to the Refiner team. We need this information to complete the SAML SSO setup on our side.<\/p>\n\n\n\n<p>The metadata usually includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Email domain<\/li>\n\n\n\n<li>IdP Entity ID<\/li>\n\n\n\n<li>Login URL<\/li>\n\n\n\n<li>Logout URL<\/li>\n\n\n\n<li>Signing certificate<\/li>\n<\/ul>\n\n\n\n<p>Once we receive this information, we will finalize the configuration for your account.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Configure user attributes<\/h2>\n\n\n\n<p>Please make sure your Identity Provider sends the following user attributes to Refiner when authenticating users:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Attribute<\/th><th>Required<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td><code>email<\/code><\/td><td>Yes<\/td><td>The user\u2019s email address<\/td><\/tr><tr><td><code>first_name<\/code><\/td><td>Yes<\/td><td>The user\u2019s first name<\/td><\/tr><tr><td><code>last_name<\/code><\/td><td>Yes<\/td><td>The user\u2019s last name<\/td><\/tr><tr><td><code>role<\/code><\/td><td>No<\/td><td>The user\u2019s role in Refiner<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>The <code>role<\/code> attribute is optional. If no role is provided, new users will be assigned the <code>Manager<\/code> role by default.<\/p>\n\n\n\n<p>The following role values are supported:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>admin<\/code><\/li>\n\n\n\n<li><code>manager<\/code><\/li>\n\n\n\n<li><code>contributor<\/code><\/li>\n\n\n\n<li><code>analyst<\/code><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Check settings<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Signing of Responses and Assertions<\/h3>\n\n\n\n<p>Refiner requires both SAML responses and assertions to be signed. Please make sure signing is enabled for both in your Identity Provider.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">NameId Format<\/h3>\n\n\n\n<p>Refiner expects the NameID format to be set to:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\n<\/pre>\n\n\n\n<p>This means Refiner expects a stable, persistent user identifier.<\/p>\n\n\n\n<p>If your Identity Provider cannot use the persistent NameID format, Refiner can also support the email address NameID format:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\n<\/pre>\n\n\n\n<p>Please let us know if you need to use the email address NameID format instead.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Test authentication<\/h2>\n\n\n\n<p>Once the setup is complete, log out of your Refiner account and go to the Refiner login screen.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1013\" src=\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-1024x1013.png\" alt=\"\" class=\"wp-image-28674\" srcset=\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-1024x1013.png 1024w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-800x792.png 800w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-768x760.png 768w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37.png 1510w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>Choose <strong>Sign in with SSO<\/strong> and enter your email address. You should be redirected to your Identity Provider, where you can authenticate with your organization credentials.<\/p>\n\n\n\n<p>After successful authentication, you will be redirected back to Refiner and should be logged in automatically.<\/p>\n\n\n\n<p>We recommend testing the setup with one or two users before rolling it out to your entire organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7: Enforce SSO<\/h2>\n\n\n\n<p>After you have confirmed that authentication via SSO is working correctly, let the Refiner team know.<\/p>\n\n\n\n<p>We will then enforce SSO as the required authentication method for your account. From that moment on, users will no longer be able to log in to Refiner with email and password. All authentication will happen through your Identity Provider.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Refiner supports authentication through SAML Single Sign-On. SAML SSO allows your organization to manage user access to Refiner through your Identity Provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, or another SAML-compatible provider. Setting up SAML SSO for Refiner is currently a manual process. It requires coordination between your Refiner account team and [&#8230;]<\/p>\n<p><a class=\"btn btn-secondary understrap-read-more-link\" href=\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/\">Read More&#8230;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","template":"","knowledgebase_tag":[],"class_list":["post-28670","knowledgebase","type-knowledgebase","status-publish","hentry","knowledgebase_cat-authentication"],"acf":[],"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","ab-block-post-grid-landscape":"","ab-block-post-grid-square":"","gb-block-post-grid-landscape":"","gb-block-post-grid-square":""},"post_excerpt_stackable_v2":"<p>Refiner supports authentication through SAML Single Sign-On. SAML SSO allows your organization to manage user access to Refiner through your Identity Provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, or another SAML-compatible provider. Setting up SAML SSO for Refiner is currently a manual process. It requires coordination between your Refiner account team and your organization\u2019s Identity Provider administrator. SAML SSO is included in Refiner Enterprise plans. For customers on Essentials and Growth plans, SAML SSO can be enabled for a one-time setup fee. Once SAML SSO is enabled, your organization can control which users have access to Refiner&hellip;<\/p>\n","category_list_v2":"","author_info_v2":{"name":"Moritz Dausinger","url":"https:\/\/refiner.io\/docs\/author\/user\/"},"comments_num_v2":"0 comments","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Set up SAML SSO<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Set up SAML SSO\" \/>\n<meta property=\"og:description\" content=\"Refiner supports authentication through SAML Single Sign-On. SAML SSO allows your organization to manage user access to Refiner through your Identity Provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, or another SAML-compatible provider. Setting up SAML SSO for Refiner is currently a manual process. It requires coordination between your Refiner account team and [...]Read More...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/\" \/>\n<meta property=\"og:site_name\" content=\"Refiner Documentation\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-17T16:05:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-1024x1013.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/\",\"url\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/\",\"name\":\"Set up SAML SSO\",\"isPartOf\":{\"@id\":\"https:\/\/refiner.io\/docs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-1024x1013.png\",\"datePublished\":\"2026-06-17T15:47:34+00:00\",\"dateModified\":\"2026-06-17T16:05:24+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#primaryimage\",\"url\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37.png\",\"contentUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37.png\",\"width\":1510,\"height\":1494},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/refiner.io\/docs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Set up SAML SSO\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/refiner.io\/docs\/#website\",\"url\":\"https:\/\/refiner.io\/docs\/\",\"name\":\"Refiner Documentation\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/refiner.io\/docs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/refiner.io\/docs\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/refiner.io\/docs\/#organization\",\"name\":\"Refiner Documentation\",\"url\":\"https:\/\/refiner.io\/docs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png\",\"contentUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png\",\"width\":400,\"height\":61,\"caption\":\"Refiner Documentation\"},\"image\":{\"@id\":\"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Set up SAML SSO","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/","og_locale":"en_US","og_type":"article","og_title":"Set up SAML SSO","og_description":"Refiner supports authentication through SAML Single Sign-On. SAML SSO allows your organization to manage user access to Refiner through your Identity Provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, or another SAML-compatible provider. Setting up SAML SSO for Refiner is currently a manual process. It requires coordination between your Refiner account team and [...]Read More...","og_url":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/","og_site_name":"Refiner Documentation","article_modified_time":"2026-06-17T16:05:24+00:00","og_image":[{"url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-1024x1013.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/","url":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/","name":"Set up SAML SSO","isPartOf":{"@id":"https:\/\/refiner.io\/docs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#primaryimage"},"image":{"@id":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#primaryimage"},"thumbnailUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37-1024x1013.png","datePublished":"2026-06-17T15:47:34+00:00","dateModified":"2026-06-17T16:05:24+00:00","breadcrumb":{"@id":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#primaryimage","url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37.png","contentUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-17-at-17.50.37.png","width":1510,"height":1494},{"@type":"BreadcrumbList","@id":"https:\/\/refiner.io\/docs\/kb\/authentication\/set-up-saml-sso\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/refiner.io\/docs\/"},{"@type":"ListItem","position":2,"name":"Set up SAML SSO"}]},{"@type":"WebSite","@id":"https:\/\/refiner.io\/docs\/#website","url":"https:\/\/refiner.io\/docs\/","name":"Refiner Documentation","description":"","publisher":{"@id":"https:\/\/refiner.io\/docs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/refiner.io\/docs\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/refiner.io\/docs\/#organization","name":"Refiner Documentation","url":"https:\/\/refiner.io\/docs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/","url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png","contentUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png","width":400,"height":61,"caption":"Refiner Documentation"},"image":{"@id":"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/28670","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/types\/knowledgebase"}],"author":[{"embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/comments?post=28670"}],"version-history":[{"count":4,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/28670\/revisions"}],"predecessor-version":[{"id":28684,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/28670\/revisions\/28684"}],"wp:attachment":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/media?parent=28670"}],"wp:term":[{"taxonomy":"knowledgebase_tag","embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase_tag?post=28670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}