Single sign-on (SSO) allows your users to log in to your application using their existing SAML-enabled ID provider, such as EntraID, OneLogin, Okta, and many more.
SAML SSO is available with Aha! Builder Scale. Your account’s Governance policy controls whether application owners can configure SAML for their applications.
Click any of the following links to skip ahead:
How it works
When a user opens an application that uses SAML SSO, Aha! Builder redirects them to your identity provider to authenticate. If they already have an active session with that provider, they can return to the application without entering their credentials again.
A SAML provider can support one or more applications. When it supports more than one application, you can configure it to send users directly to the application they need.
Enable SSO for your application
From your application in Aha! Builder, navigate to Configuration -> Authentication.
Next to Custom SSO (SAML, JWT), select Add provider. Then select SAML.
Add a Name for the SSO configuration and select Create provider.
The SAML configuration will display. You will use the information you find here to configure your SAML identity provider.
Click Enable SSO to complete the configuration. The integration window will close.
Configure your SAML identity provider
The last step in configuring your ideas portal for SAML 2.0 SSO is to configure your identity provider so that it will send your Aha! account the right information. Particularly, you should ensure that the identity provider is sending the right user attributes to your Aha! Builder application:
EmailAddress
FirstName
LastName
-
NameID
We strongly recommend using a persistent, unique identifier in this field rather than the user's email address.
Your Aha! account uses these attributes to identify users and match them to users in your Aha! account or ideas portal.
In Aha! Builder, open the configuration you just created so it is available for easy reference.
In a separate browser window or tab, log in to your SAML identity provider.
Configure your SAML identity provider.
Save the configuration.
There are many SAML SSO identity providers. How you configure SAML within your identity provider depends on their requirements. Setting up SSO for your Aha! Builder application is similar to setting it up for an Aha! ideas portal. If you get stuck, check out our articles for setting up SSO for ideas portals for the following identity providers:
Send users to a specific application
Use RelayState to send users directly to an application after they authenticate. This is useful when several applications use the same identity provider.
In your identity provider, set the application’s RelayState value. Your provider may call this field Default Relay State, Target URL, or Start URL. It uses your Aha! Builder application's reference (sometimes called prefix). This is the reference added to the application record.
For this example, we will use APPMAT as the application's reference. Use one of the following values:
A relative application path, such as
/apps/my-builder-app/APPMAT, where APPMAT is the application's reference.-
The full application URL, such as
https://your-workspace.aha.io/builder/applications/APPMAT.You can copy this value directly. Open your application in Aha! Builder and navigate to Strategy -> Overview. Then select the application reference to copy its full application URL.
After the user signs in, Aha! Builder uses the RelayState value to find and open the requested application. If the value is missing, invalid, or does not match an application the user can access, Aha! Builder shows the application chooser instead.
RelayState only controls where users go after authentication. It does not change how Aha! Builder authenticates them.
Share your SSO configuration across applications
Once you set up an SSO configuration, you can use it for any application in your account.
Open the application in Aha! Builder and go to Configuration -> Authentication.
Find the SSO configuration and click the toggle to enable it.