📌 Note: This feature is only available on our Enterprise or Network plans. For help adjusting your plan please contact support at [email protected].

Single sign-on (SSO) allows you to give members of your team one account to sign into all the systems your organization uses. NationBuilder allows you to integrate your nation as a service provider with your SAML 2.0 identity provider. 

Your permission set must have access to the Settings section of the control panel and you must have the "Manage authentication modes" permission to use these instructions. 

Go to Settings > Auth > + New provider. If you do not see the Auth option in Settings, contact your Enterprise Account Manager to have single sign-on enabled. Your nation must be on the Enterprise or Network plan to use this feature.

1. Enter the provider name.

2. The slug for the provider will be generated automatically based on the name entered. Any consecutive series of characters that are not English alphanumeric characters, underscores, or dashes will be replaced with a single underscore in the automatically generated slug. You can edit the slug, which can include English alphanumeric characters, underscores, or dashes.

3. Once the name and slug are created, information that needs to be added to your identity provider's control panel will display on the right side.

Note that your identity provider's slug is included in these credentials. If changes are made to the provider slug field, these credentials will be updated once the cursor is moved out of the slug field.

4. Log into your identity provider's control panel and add the NationBuilder application details as described above. The entity ID, assertion consumer service URL, and single sign-out endpoint are unique to each identity provider within a nation and should be copied directly from your nation's control panel. 

5. Add the identity provider to NationBuilder. 

The unique ID, single sign-on endpoint, and X.509.pem certificate fields are required.

Be sure to include the entire X.509.pem certificate. This means that the information is enclosed between "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" The lines beginning and ending the certificate must be included for the certificate to be valid.

6. You have the option of giving new users access to your control panel. If you check this box, you then need to choose a permission set for new users.

When the box is unchecked, new users signing in through your identity provider will only be able to access areas of your public website; they will not have access to your control panel. Since this option provides the same level of access to your control panel for all new users, you also have the option of mapping IDs within profiles, and specifying different permission sets for each user. 

7. Click the Save button to save your identity provider.

You will need to update your theme to display your new authentication provider on your website. The following code example will display the login button on your page.  Simply replace slug with the correct slug assigned to your provider in the control panel.

{% if request.authentication_modes.slug %}
<a class="sign-in-button" title="Sign in with SSO" href="{{ request.authentication_modes.slug.sign_in_url }}">SSO Provider</a>
{% endif %}

Once an identity provider is created in the Settings section, profiles in your people database will include a new section to view and edit identity mapping.

The "Identity mappings" section of a profile will include space to insert a unique identifier for each provider created in the Settings section. This will allow you to complete the integration process if you are not using just in time provisioning. Having access to a profile's identity mappings also allows you to specify different permission sets for people, rather than providing the same permission set for all control panel users logging in with the identity provider. 

Please note that a user must already exist in your identity provider. Inserting a unique ID in a NationBuilder profile will not create that ID in your SAML SSO provider. 

Once an identity provider is created in the Settings section of the control panel, identity mappings can be added to profiles by importing them in a one-time import or a voter import.

The identity mapping connects a profile to an identity provider, but it is not a unique identifier for a NationBuilder profile. This means that when you import identity mappings, you must import an additional unique ID.

If you are using the email attribute as your name identifier format in your identity provider, you could duplicate the email address field in your CSV and then map the email address field twice: first as the signup email address, then within the SSO Identity Mappings category, to the field labeled for a particular identity provider.

Once an identity provider is created in the Settings section of the control panel, a new filter category will appear in the People section. Select "SSO identity mappings," then select "External user identifier." A row will be added to your filter criteria. You will have to select a particular identity provider to search within. Then, you can search whether the external user identifier:

Use SAML with NationBuilder SSO
​How to manage control panel users