Skip to content
FreesbeFreesbe DocsBack to freesbe.net

Set up single sign-on with OneLogin

How-toFor adminsReviewed Guides: Single sign-on, Admin Center

Connect OneLogin so people sign in to Freesbe with their OneLogin account and its MFA, and OneLogin’s roles decide who gets in.

Before you start

Section titled “Before you start”
  • Single sign-on with your own provider comes with the Corporate and Enterprise plans.
  • Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
  • You need to be an owner of the workspace in Freesbe, and able to add apps in OneLogin.
  • Keep the Freesbe page open in one tab and OneLogin in another: you copy details both ways.

1. Start in Freesbe

Section titled “1. Start in Freesbe”
  1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
  2. Choose OneLogin and SAML 2.0, then Set up OneLogin.
  3. The page shows Add Freesbe to OneLogin with the details to copy. Leave it open.

2. Add Freesbe to OneLogin

Section titled “2. Add Freesbe to OneLogin”
  1. In OneLogin’s administration, go to Applications → Applications and click Add App. Search for SAML Custom Connector (Advanced) and pick it.
  2. Name it Freesbe and Save.
  3. On Configuration, paste Freesbe’s Entity ID into Audience (EntityID) and its Reply URL into Recipient and ACS (Consumer) URL. For ACS (Consumer) URL Validator, use the same address. Save.
  4. On Parameters, set NameID value to Email.
  5. On SSO, copy the Issuer URL (OneLogin’s metadata).
  6. Under Access (or Users), give the people or roles who use Freesbe access.

3. Tell Freesbe about OneLogin

Section titled “3. Tell Freesbe about OneLogin”

Under Tell Freesbe about OneLogin, paste the issuer URL as the metadata URL and click Save.

4. Test it

Section titled “4. Test it”
  1. Back on the Freesbe page, under Test it, click Test sign-in.
  2. Sign in to OneLogin as yourself. You’re brought back to the page, which says Signed in and shows what OneLogin sent: your email address, name and any other attributes.
  3. Nobody else can sign in through OneLogin until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

Section titled “If the test doesn’t sign in”

The page says why. The usual reasons:

  • “isn’t at one of this workspace’s verified email domains”: OneLogin sent an address at another domain, or a username instead of the email. Send the user’s primary email as the NameID value (Email).
  • “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one OneLogin signs with. Paste the metadata URL again, or upload the new metadata file.
  • “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in OneLogin doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
  • “is encrypted”: turn off assertion encryption for the Freesbe app.
  • The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in OneLogin.

See Single sign-on for everything else.

With OpenID Connect instead

Section titled “With OpenID Connect instead”

Choose OpenID Connect in step 1, and add OneLogin’s OpenId Connect (OIDC) app. Paste Freesbe’s Redirect URL under Redirect URI’s, and on SSO set Token Endpoint to POST. In Freesbe enter the issuer (https://<your subdomain>.onelogin.com/oidc/2), the Client ID and the Client Secret.