Configure Single Sign-On (SAML) with Any Identity Provider

This article explains how to configure SAML 2.0 single sign-on between Forumbee and any SAML-compatible identity provider (IdP). Use it if your IdP does not have a dedicated setup guide, or if you are building the configuration from scratch.

If you use Okta, Microsoft Entra ID / Microsoft 365, or Auth0, follow the provider-specific guide instead, since it includes screenshots and exact field names for that product.

How Forumbee acts in a SAML integration

Forumbee is the service provider (SP). Your identity provider (IdP) authenticates the user and sends Forumbee a signed SAML assertion containing the user’s identity and profile data.

Supported features:

• SP-initiated SSO (user starts at the Forumbee login page)
• IdP-initiated SSO (user starts from a tile or app launcher in the IdP)
• Just-in-time user creation and profile updates on each login
• Group and role assignment through SAML claims
• Single Logout (SLO)

Before you begin

You will need:

• Administrator access to your Forumbee community
• Administrator access to your identity provider
• The ability to create a custom or non-gallery SAML 2.0 application in your IdP

Leave Enforce SSO disabled until you have tested login successfully. Enabling it before the configuration works can lock you out of your own community.

Step 1: Collect the service provider values from Forumbee

1. Log in to Forumbee as an administrator.
2. Navigate to Admin > Integrations > SAML.
3. Expand the SSO Settings panel.

This panel contains the values your IdP needs. Different IdPs use different labels for the same values, so use the table below to map them.

Keep this panel open in a second browser tab. You will come back to it.

Step 2: Create the SAML application in your identity provider

In your IdP, create a new SAML 2.0 application. Most IdPs describe this as a custom, non-gallery, or generic SAML app.

Enter the Forumbee values you collected in Step 1:

• ACS / Reply / Callback URL: the SSO Consumer URL
• Entity ID / Audience / Identifier: the Audience value
• Logout URL, if the IdP asks for one at this stage: the Single Logout URL

Additional settings that apply to most providers:

• Name ID format: set to Unspecified unless you have a specific reason to use another format.
• Name ID value: set to the identifier you want to use as the user’s permanent unique ID. See “Passing a unique user ID” below.
• Relay State: leave blank. Forumbee does not require a default RelayState value.
• Signing: the IdP should sign the SAML assertion or the response. Forumbee validates the signature using the IdP certificate you provide in Step 4.

Step 3: Configure the attribute claims

Forumbee reads user data from SAML attribute statements (called claims, attributes, or mappings depending on the IdP).

Required claims

email

Recommended claims

firstname

lastname

id

Optional claims

tagline

avatar

groups

role

1

_fieldname

Claim naming rules

1. Use the exact claim names shown above, in lowercase. Forumbee matches on the literal claim name. email works; Email, emailAddress, or mail does not.
2. Use short, unqualified claim names. Forumbee expects the short name, such as email. If your identity provider prefixes claim names with a URI, for example http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, edit the name so only the short form remains. If your identity provider has a separate Namespace field, clear it.

Where a Name format option exists, Unspecified is the safest choice.

Step 4: Enter the identity provider values into Forumbee

Back in your IdP, locate the SAML metadata or sign-on details. Most providers expose these on a metadata, setup, or usage tab, and some offer a metadata XML file or URL that contains all of them.

1. In Forumbee, go to Admin > Integrations > SAML and expand Identity Provider Setup.

2. Enter the following:

For the certificate, download it from your IdP in Base64 / PEM format, open it in a plain text editor, and paste the full contents into the Certificate field. Include the BEGIN CERTIFICATE and END CERTIFICATE lines. Do not upload a binary DER or PFX file.

3. Click Save at the bottom of the Identity Provider Setup panel.

Step 5: Assign users and test

1. In your IdP, assign the users or groups who should have access to the Forumbee application. Users who are not assigned will not be able to log in.
2. In Forumbee, click Enable at the top of the SAML 2.0 page to turn SSO on.
3. Test the login with a non-administrator test account before rolling it out. Confirm that the account is created, the name and email are correct, and any group or role claims applied as expected. If anything does not work as expected, click the Log tab on the SAML page to see what your identity provider sent.

Configure Forumbee login options

Expand the Login Options panel in the SAML 2.0 settings.

• Enforce SSO: requires all users to log in through your IdP. Leave this off until you have verified that SSO works, otherwise you risk locking yourself out.
• IP address range: requires users coming from specified IP addresses to log in through SSO.
• Show SSO option on Forumbee login form: on by default. Adds an SSO button to the Forumbee login page, with a customizable label.
• Allow users to change their own display name: when enabled, users can set a display name that differs from the one sent by your IdP. Turn this off if you want the name and other profile fields to be overwritten with the SAML values on every login.

Advanced configuration

Passing a unique user ID

Email addresses change. To keep a user’s account stable when their email changes, pass a permanent identifier from your system in the Name ID of the SAML assertion. The email claim is still required alongside it.

Group assignment

Pass a claim named groups containing a comma-separated list of Forumbee group names or group IDs.

To find a group ID, go to Admin > Users > Groups and click the group. The group ID is the five-character code at the end of the page URL.

To remove a user from a group, prefix the name or ID with an exclamation mark, for example !clients. This is useful for keeping Forumbee membership in sync when a user is removed from a group in your IdP, since omitting the group from the claim does not remove existing membership on its own.

Most IdPs support some form of conditional expression or group filter for building this value. The syntax varies by provider, so consult your IdP’s documentation for how to emit a comma-separated string based on the user’s group memberships.

Best practice: avoid spaces in group names in both systems. This produces the most reliable results in group assignment rules.

Role assignment

Users are assigned the standard Member role by default. To elevate a user to Moderator, pass a claim named role with the value 1.

Users cannot be elevated to the Admin role through SAML. The Admin role can only be assigned from the Users area in the Forumbee admin console.

Custom profile fields

To populate a custom profile field, first create the field in Forumbee. Then create a SAML claim whose name is the field name prefixed with an underscore, with spaces replaced by underscores.

Example: a custom profile field named “Company Name” maps to a claim named _company_name.

Profile pictures

Pass a claim named avatar containing a URL to the image. The URL must be reachable without authentication.

Configure Single Logout

Single Logout ensures that when a user logs out of Forumbee, they are also logged out of the identity provider in the same browser session.

1. In Forumbee, expand the SSO Settings panel.
2. Under Certificate, click Generate new certificate.
3. Copy the generated certificate text into a plain text file.
4. In your IdP, upload or paste this certificate as the application’s signature verification certificate. This lets the IdP verify that logout requests genuinely came from Forumbee.
5. Enable Single Logout in your IdP, or enable the setting that allows the application to initiate Single Logout.
6. Provide the IdP with the Forumbee Single Logout URL and the Forumbee Audience value, which the IdP may label as the SP Issuer or SP Entity ID.
7. In Forumbee, confirm that the SLO Logout URL in Identity Provider Setup contains your IdP’s logout endpoint.

Troubleshooting

Check the SAML log first

Forumbee records SAML activity in a log you can view from the integration page. In Admin > Integrations > SAML, click the Log tab. The log is the fastest way to see what your identity provider actually sent, rather than inferring it from the symptom, and it should be your first stop for any failed or unexpected login.

The table below covers common symptoms and their usual causes.

Related articles

• SAML SSO Advanced Settings FAQ
• Configure Single Sign-On (SAML) with Okta
• Configure Single Sign-On (SAML) with Microsoft Entra ID and Microsoft 365
• Configure Single Sign-On (SAML) with Auth0