Talk with SupportBook a DemoTry for free

Tutorial: Authenticate Using SAML with Any SAML 2.0 Identity Provider⁠

Overview⁠

Configure a SAML 2.0 identity provider (IdP) for CloudConnexa using the Other SAML 2.0 option in the SAML Setup Wizard.

Use this tutorial if your identity provider doesn't have a dedicated CloudConnexa tutorial. Examples include Auth0, PingOne, AWS IAM Identity Center, Idira (formerly CyberArk), and custom or in-house SAML identity providers.

CloudConnexa acts as the SAML service provider (SP), and your identity provider authenticates users. You'll exchange SAML metadata, configure user attributes, test authentication, and optionally map identity provider groups to CloudConnexa user groups.

This tutorial explains the values and settings CloudConnexa requires. Refer to your identity provider documentation for the corresponding administration console procedures.

If your identity provider is listed here, use its dedicated tutorial instead:

Before you begin⁠

You need:

  • CloudConnexa: The Owner or Administrator role for the Wide-area Private Cloud (WPC) you're configuring.

  • Identity Provider: Permission to create and configure a SAML 2.0 application.

  • Access to both administration portals: Keep both open while you configure SAML because you'll exchange values between them.

For more information about SAML authentication, refer to Set SAML Single Sign-On Authentication for Users.

Step 1: Start the SAML Setup Wizard⁠

Select the generic SAML identity provider option in CloudConnexa.

  1. Sign in to your WPC's Administration Portal at your Cloud ID address (for example, yourcompany.openvpn.com).

  2. Navigate to Settings → User Authentication.

  3. Select Edit.

  4. On the SAML Single Sign-On card, select Setup.

  5. Under Select Your Identity Provider, select Other SAML 2.0.

    • The wizard displays the configuration steps for a generic SAML 2.0 identity provider.

Step 2: Get the service provider values for CloudConnexa⁠

Your IdP needs service provider (SP) values from CloudConnexa to send SAML authentication responses to the correct WPC.

  1. Under Share CloudConnexa Metadata, select Download.

    • The metadata file (.xml) downloads to your machine.

  2. Or, you can copy the following values:

    CloudConnexa value

    Format

    Other names your provider may use

    Single Sign-On URL (ACS)

    https://sso-backend.openvpn.com/sso/api/v1/saml/acs

    Assertion Consumer Service URL, ACS URL, Reply URL, Recipient, Consumer URL

    Issuer Name

    <cloud-id>.openvpn.com

    SP Entity ID, Audience, Audience URI, Identifier, Client ID

  3. Keep the wizard open. You'll return to it after configuring your identity provider.

For more information, refer to SAML and SCIM Service Provider Endpoints for CloudConnexa.

Step 3: Configure the SAML application in your identity provider⁠

Create an application representing CloudConnexa in your identity provider.

Menu names vary by provider. Use the following requirements to identify the corresponding settings.

Create and configure the application⁠

  1. Sign in to your identity provider's administration console.

  2. Create a SAML 2.0 application or custom SAML integration.

  3. Import the CloudConnexa service provider metadata XML file, if supported.

    Otherwise, enter the Single Sign-On URL (ACS) and Issuer Name from Step 2 into the corresponding fields.

  4. Configure the application to send SAML responses to the CloudConnexa ACS URL using the HTTP-POST binding.

  5. Configure your identity provider to send a signed assertion.

  6. Save and activate the application.

  7. Assign the application to the users or groups that need to authenticate to CloudConnexa.

Configure user attributes⁠

  1. Add SAML attributes that provide the user information CloudConnexa needs.

    User information

    What you ridentity provider needs to send

    Email address

    The user's email address

    Username

    The user identifier CloudConnexa should use

    First name

    The user's given name

    Last name

    The user's surname

    Group membership (optional)

    A multi-valued attribute containing group or role information

  2. Record the exact SAML attribute names configured in your identity provider. You'll enter them in CloudConnexa in Step 5.

Configure group attributes (optional)⁠

If you want CloudConnexa to assign user groups based on identity provider membership:

  1. Configure a SAML attribute containing the user's groups or roles.

  2. Set the attribute to send multiple values if the user belongs to multiple groups.

  3. Record the attribute name and the value it sends.

    • You'll use this multi-valued attribute in the CloudConnexa attribute mapping and user group mapping rules.

Get the identity provider metadata⁠

  1. After configuring the SAML application, locate the identity provider metadata. Your provider may call it:

    • SAML metadata

    • Federation metadata

    • IdP metadata

    • IdP descriptor

    • SAML 2.0 metadata

  2. Copy the metadata URL if your provider publishes one. Otherwise, download or copy the metadata XML document.

    • You'll provide this information to CloudConnexa in the next step.

Step 4: Connect your identity provider to CloudConnexa⁠

Provide the identity provider metadata to CloudConnexa so the wizard can configure the SSO endpoint, issuer, and signing certificate.

Choose one of the following methods.

Option 1: Use the metadata URL⁠

Use this method if your identity provider publishes a metadata URL that CloudConnexa can access.

  1. Return to the CloudConnexa SAML Setup Wizard.

  2. Select Next Step to open Provide Other SAML 2.0 Details.

  3. Select Metadata URL.

  4. In IdP Federation Metadata URL, paste the metadata URL from your identity provider.

  5. Wait for Metadata retrieved to display.

    • CloudConnexa retrieves the SSO endpoint, issuer, and signing certificate from the metadata.

  6. Verify the issuer and signing certificate expiration date.

  7. Leave Advanced Settings at their defaults unless your identity provider requires different settings.

  8. Select Next Step.

Option 2: Use the metadata XML⁠

Use this method if your identity provider provides an XML document or CloudConnexa can't retrieve the metadata URL.

  1. Return to the CloudConnexa SAML Setup Wizard.

  2. Select Next Step to open Provide Other SAML 2.0 Details.

  3. Select Metadata XML.

  4. Paste the metadata XML content or upload the XML file obtained from your identity provider.

  5. Verify the issuer and signing certificate details.

  6. Leave Advanced Settings at their defaults unless your identity provider requires different settings.

  7. Select Next Step.

Option 3: Configure the identity provider manually⁠

Use manual configuration only if your identity provider doesn't publish SAML metadata.

  1. Return to the CloudConnexa SAML Setup Wizard.

  2. Select Next Step to open Provide Other SAML 2.0 Details.

  3. Select Manual.

  4. Enter the following values from your identity provider:

    CloudConnexa field

    Value

    IdP Authentication Endpoint

    The identity provider SAML SSO endpoint

    Signing Certificate (X.509, PEM)

    The identity provider certificate used to verify SAML signatures

  5. Review Advanced Settings and change them only if required by your identity provider.

  6. Select Next Step.

Step 5: Map user attributes⁠

Map the SAML attributes sent by your identity provider to the corresponding CloudConnexa user fields.

  1. On Map User Attributes, turn on Allow user attributes mapping (Optional).

  2. Enter the exact attribute names configured in Step 3.

    CloudConnexa field

    What to enter

    Example of names to look for

    Email Address

    Attribute containing the user's email address

    email, mail

    Username

    Attribute containing the intended user identifier

    username, uid, userPrincipalName

    Group

    Attribute containing group or role membership

    groups, memberOf, roles

    First Name

    Attribute containing the user's given name

    firstName, givenName

    Last Name

    Attribute containing the user's surname

    lastName, sn

  3. Verify that each mapped name matches the SAML attribute exactly, including capitalization.

  4. If you're not configuring user group mapping, you can leave the Group attribute unmapped.

  5. Select Next Step.

Find the SAML attribute names your provider sends⁠

If you aren't sure which attribute names to enter, inspect a SAML assertion generated for a test user.

You can use either method:

  • Identity provider preview: Some administration consoles let you preview the SAML assertion for an assigned user. Review the attribute names and values in the preview.

  • SAML tracer browser extension: Use a SAML tracer browser extension to capture the SAML authentication exchange. Open the captured SAML response and inspect the assertion. Look for the Name value on each Attribute element.

For example, the following assertion fragment contains an attribute named email:

<saml:Attribute Name="email">
  <saml:AttributeValue>user@example.com</saml:AttributeValue>
</saml:Attribute>

Enter email in the Email Address mapping field if that's the name your provider sends. If your provider uses a different attribute name, enter that exact name instead.

If a mapping is incorrect, you can change it later under Configuration → Attribute Mapping.

Step 6: Test SAML authentication⁠

Test the connection to verify that CloudConnexa accepts authentication responses from your identity provider.

  1. In the wizard, the Test SAML SSO Connection step displays.

  2. Select Sign in With SAML SSO.

  3. Authenticate with an identity provider account assigned to the CloudConnexa application.

  4. Review the test results. CloudConnexa checks the SAML response for:

    • A response received at the ACS endpoint.

    • A valid signature.

    • An issuer that matches the configuration.

    • An audience that matches the SP Entity ID.

    • An assertion timestamp within the allowed clock skew.

  5. The wizard shows whether each check passed or failed.

Verify the user attributes⁠

  1. The test also displays the user information received from your identity provider:

    • Email

    • First Name

    • Last Name

    • IdP Group

    • Username

  2. If a field displays -, CloudConnexa didn't receive a value under the expected attribute name. Compare the attribute statements in your identity provider with the mappings from Step 5.

If the test fails⁠

  1. Review the check.

  2. Correct the configuration.

  3. Select Run Test Again.

    • Although the wizard allows you to continue after a failed test, we recommend resolving the errors before completing setup. Otherwise, users may be unable to authenticate.

SP-initiated and IdP-initiated authentication⁠

Start the test from the CloudConnexa wizard, which uses service provider-initiated (SP-initiated) authentication.

You can configure identity provider-initiated (IdP-initiated) authentication from your provider's application dashboard separately for the CloudConnexa User Portal using Relay State. For that procedure, refer to Tutorial: Set Up IdP-Initiated SAML SSO to the User Portal.

Step 7: Review and complete the configuration⁠

The Configuration Details step summarizes the SAML settings you've configured.

  1. Review the following information:

    Setting

    What to verify

    Metadata Source

    How you supplied the identity provider metadata

    Attributes Mapped

    The number of configured attribute mappings

    Issuer

    The identity provider issuer value

    Signing Certificate

    Certificate validity and expiration date

  2. You can also review the advanced settings, including Data Binding, Authentication Lifetime, Reconnecting, Authentication Context, and Logout URL.

    • The wizard may display additional setup options for user group mapping and SCIM provisioning.

  3. When you're satisfied with the configuration, select Complete.

Update the identity provider signing certificate⁠

Your identity provider uses a signing certificate to sign SAML assertions. If the certificate expires or rotates, authentication can fail until CloudConnexa receives the updated certificate.

The Configuration Details step displays the number of days remaining before the certificate expires. Check the expiration date and plan to update the metadata when the certificate changes.

To update the signing certificate in CloudConnexa:

  • Metadata URL: Provide the metadata URL again to retrieve the updated certificate.

  • Metadata XML: Import the updated metadata XML document.

  • Manual: Update the signing certificate in the CloudConnexa configuration.

After updating the metadata, test SAML authentication to verify that CloudConnexa accepts the new certificate.

Optional: Configure user group mapping⁠

If you want CloudConnexa to assign users to user groups based on their IdP group membership, configure SAML user group mapping.

  1. In the CloudConnexa Administration portal, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → User Group Mapping.

  2. Configure mapping rules for the group information the IdP sends.

For detailed instructions, refer to Set SAML User Group Mapping Rules.

Group mapping is evaluated when users authenticate. If you change a user's group membership in the IdP, the updated mapping takes effect the next time they authenticate to CloudConnexa.

Optional: Configure SCIM provisioning⁠

SAML authenticates users when they access CloudConnexa. You can also configure System for Cross-domain Identity Management (SCIM) 2.0 to automate user provisioning.

With SCIM provisioning, the IdP can create, update, and deactivate users in CloudConnexa without waiting for authentication.

  1. To configure SCIM, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0.

Manage your SAML configuration⁠

After completing the wizard, you can review or change your configuration under Settings → User Authentication → SAML Single Sign-On → Configuration.

Configuration

What you can manage

IdP Configuration

Identity provider metadata, SSO endpoint, issuer, and signing certificate

Attribute Mapping

SAML attributes mapped to CloudConnexa user fields

User Group Mapping

Rules for assigning CloudConnexa user groups

SCIM 2.0

Automatic user provisioning

Troubleshooting⁠

Use these checks if authentication fails or CloudConnexa doesn't receive the expected user information.

Issue

Likely cause

What to check

The test reports that the response wasn't received at the ACS endpoint.

Your identity provider sent the response to a different URL or didn't use the HTTP-POST binding.

Verify that the ACS URL, Reply URL, or equivalent field matches the CloudConnexa Single Sign-On URL (ACS) from Step 2. Confirm that the provider uses HTTP-POST.

The test reports a signature failure.

The assertion isn't signed, or the signing certificate in CloudConnexa doesn't match the certificate used by your identity provider.

Verify that the identity provider signs SAML assertions. Retrieve the current metadata and update IdP Configuration.

The test reports an issuer mismatch.

The issuer configured in CloudConnexa doesn't match the issuer in the SAML response.

Compare the issuer in Configuration Details with the value published in your identity provider metadata.

The test reports an audience mismatch.

The identity provider was configured with the wrong CloudConnexa Issuer Name.

Compare the Audience, Entity ID, Identifier, or equivalent field with the Issuer Name from Step 2.

The test reports a timestamp failure.

The assertion has expired or its validity period doesn't match the allowed clock skew.

Retry the test. If it continues to fail, investigate the assertion timestamps and clock synchronization.

The user authenticates but has no name or email.

The attribute claims are missing or named differently from the configured mapping.

Inspect the SAML assertion using the identity provider preview or a SAML tracer browser extension. Compare the attribute names with Configuration → Attribute Mapping.

The user isn't assigned to the expected CloudConnexa user group.

The group attribute is missing, contains unexpected values, or has no matching mapping rule.

Verify the identity provider sends the correct multi-valued group attribute. Review the SAML user group mapping rules.

Authentication worked previously but stopped.

The identity provider signing certificate expired or rotated.

Check the certificate expiration date under IdP Configuration. Retrieve the updated metadata or certificate and test authentication again.

A user can't authenticate through the identity provider

The user hasn't been assigned the SAML application or doesn't meet the provider's access policy.

Verify application assignments, group membership, and access policies in your identity provider.

CloudConnexa can't retrieve the metadata URL

The metadata endpoint is unavailable or inaccessible to CloudConnexa.

Verify the URL and network access. If the endpoint is private or inaccessible, use Metadata XML instead.

The SAML response contains unexpected or missing attributes

Your identity provider sends different claim names or doesn't include the configured attributes.

Inspect the assertion and update the attribute names in Configuration → Attribute Mapping.

User group mapping rules never apply.

The group attribute isn't included in the assertion, contains unexpected values, or sends a format that doesn't match the rules.

Verify the group attribute in the assertion and confirm that the mapping rules use the exact values sent by the identity provider.

© 2026 OpenVPN Inc. | OpenVPN is a registered trademark of OpenVPN, Inc. | CloudConnexa is a registered trademark of OpenVPN, Inc.

Service StatusPrivacy PolicyLegal