This document outlines the setup & functionality of the SAML Single Sign-On with Okta for user authentication and management. It describes the integration process, features, and steps for setup.
Key Product Benefits
Simplified Authentication
Allowing clients to sign in through their company Identity Provider.
Supporting both Service Provider (SP) initiated, and Identity Provider (IdP) initiated flows.
User Provisioning & Management
Automated user provisioning, updating and de-provisioning using SCIM.
Just-In-Time Provisioning for users that do not want to setup SCIM.
Supporting attribute mapping for custom user roles and teams.
Users provisioned through SAML will no longer need to go through the traditional user request approval process, which significantly reduces administrative overhead.
Enhanced Security
Secure handling of Name ID, attributes, and authentication contexts.
Associated Domain Authentication to ensure users belong to the correct organisation.
Feature Description & Setup
This update primarily targets large organizations
INFORMATION:
The examples below are demonstrated with Okta as the Identity provider, however, the SAML integration works across any Identity Provider which supports SAML 2.0.
Each IdP may have a slightly different interface for configuration, but the core setup process remains the same:
Create an application within the IdP.
Configure the ACS URL and SP Entity ID provided by the Service Provider (CisionOne).
Map attributes like email, first_name, last_name, and custom roles.
If you use Microsoft Azure as your Identity Provider, refer the How can I set-up Azure SAML? to setup your SAML integration.
1. Create a new App Integration in Okta
Enter your Identity Provider admin dashboard and create a new app integration. Make sure to select SAML 2.0 if prompted with a sign-in method.
2. Copy & Paste ACS & SP Entity ID from CisionOne
Enter the SAML Integration page by going to Organisation → Integrations → SAML.
Copy the ACS URL & SP Entity ID.
Paste the ACS Url and the SP Identity ID in the appropriate fields. Use email address as the name ID format and use email as the Application Username.
3. Setup Attributes
Setup Attribute statements via the attribute's statements section of your Identity Provider. We currently require:
email
first_name
last_name
primary_team (optional)
monitoring_user_role (optional)
social_user_role (optional)
outreach_user_role (optional)
Inside Okta, scroll Down from the SAML Integration to reach the Attributes Statements section. Add the following attributes.
Make sure the required and desired optional attributes are setup in the profile editor of Okta.
4. (Optional) Upload a Signature Certificate
For organisations that require an additional layer of security, you can upload a signature certificate to Okta. This allows Okta to verify that SAML requests originate from CisionOne.
From the CisionOne SAML Integration page (Organisation → Integrations → SAML), copy the SP Entity ID URL.
Paste the SP Entity ID URL into your browser's address bar and open it. This will load the SP metadata file.
In the metadata file, locate and copy the certificate token — this is the long alphanumeric string found within the <X509Certificate> tags.
Create a new text file and paste the certificate token into it, wrapped with the following header and footer on their own lines:
-----BEGIN CERTIFICATE-----
<paste certificate token here>
-----END CERTIFICATE-----
5. Save the file with a .pem extension (e.g. cisionone-sp.pem).
6. In Okta, navigate to your SAML app's “Configure SAML” page Sign On settings,
click on the “Show Advanced Settings” button and locate the Signature
Certificate field.
7. Upload the .pem file you created.
Once uploaded, Okta will use this certificate to validate the authenticity of incoming SAML requests from CisionOne.
SAML Setup (CisionOne - Required)
1. Copy & Paste ACS & SP Entity ID from Okta
After creating the application, copy the SSO URL, Identity Provider Issuer (Identity ID) and X.509 Certificate from your Identity Provider and paste it into the Integration page in CisionOne to establish the connection.
2. Setup Associated Domains
Please add at least one Associated domain that matches the domain of your email addresses to allow the Sign in with SAML button to work.
If you will require account creation via SAML/SCIM, please verify the domain by adding a TXT record to the domain with the provided secret and clicking the verify button (Please note it may take up to several hours after the TXT record has been created for it to be visible to CisionOne as they can take time to replicate across the internet)
3. Setup Custom Attribute Value Mapping
For team and user role attribute to work, the admin must map the custom attribute values inside CisionOne.
Scroll Down in CisionOne SAML integration and open the “Custom Attributes (Optional)” accordian.
Note: if the organization does not have the optional attributes setup, they will be assigned default teams and roles as set up inside the CRM. If they do not have a default team, they will be assigned to no team.
SCIM Setup (Okta & Cision)
System for Cross-domain Identity Management (SCIM) can be used alongside SAML to automate user provisioning, deprovisioning, and profile updates.
If SCIM is not configured, users can still be created through Just-in-Time (JIT) provisioning when they sign in for the first time. However, user updates, role changes, and deprovisioning are not supported through JIT provisioning alone.
For more information about SCIM and how it differs from SAML, see Configuring SCIM provisioning with Okta.
Sign-In Flow
The integration allows for both SP-initiated and IdP-initiated authentication flows.
From the IDP
After setup, you should be able to see the created application inside user dashboards of your Identity Provider. When clicking on the tile, the browser will redirect to CisionOne and sign the user in. The tile will also provision the user if their user does not exist on Cision yet.
From CisionOne
To sign-in from CisionOne select the “Sign in with SAML” button. The user must type in their corporate email and select “Single Sign-On”. After signing in, the user may be briefly redirected to their Identity Provider and will redirect back to Cision.
If the users' email does not exist or there is an issue with their sign in, the following error message will display.
