Prerequisites

• Ensure SAML 2.0 Support: Verify that your Identity Provider (IdP) supports SAML 2.0. If unsure, contact your IdP or Mavenoid representative.

• Organization Hostname: Your Mavenoid organization should live under its own hostname, e.g., my-company.mavenoid.com. If it doesn't, reach out to your Mavenoid representative.

Setup Instructions

1. SAML App Configuration
   Request the Metadata URL and Assert URL from your Mavenoid representative to configure a SAML app in your Identity Provider (IdP).

2. Provide Information to Mavenoid
   Share the following details with Mavenoid:

   • IdP SSO URL

   • IdP SLS URL (optional)

   • x509 Certificate

   • Claim names for:

     • First name

     • Last name

     • Email address

Note: These claims are used to automatically create user accounts in Mavenoid.

[Optional] Anonymous Accounts

To keep user accounts anonymous in Mavenoid, accounts can be created using a unique identifier instead of first name, last name, and email. Provide the claim name for a metadata attribute containing this unique identifier.

Note: Analytics cannot be linked to individual users if accounts are anonymous.

Automatic Role Assignment

Mavenoid can assign roles to users automatically upon their first login. Roles can be set in one of two ways:

• Default Role Assignment
  All users logging in for the first time can receive a default role, such as Live Support Agent. A user with the Admin role in Mavenoid can later update the roles and permissions for these users.

• Dynamic Role Assignment Using IdP Metadata
  Roles can also be assigned dynamically based on user attributes provided by your Identity Provider (IdP). For example, in Microsoft Azure, the claim http://schemas.microsoft.com/ws/2008/06/identity/claims/groups can contain information about the roles a user should have in Mavenoid.

Note: Users can have multiple roles in Mavenoid. To assign multiple roles dynamically, separate them with a comma or semicolon (e.g., "Live Support Agent; Analyst") in the value of the metadata attribute.

Troubleshooting

• Sign-In Errors: If you experience issues logging in, confirm that the user has access to the Mavenoid app in your Identity Provider (IdP).

• Server Errors: If you encounter errors after being redirected back to Mavenoid from the login form, check that the mappings for user attributes (first name, last name, email, or unique identifier) are correctly configured in Mavenoid. For assistance, please contact your Mavenoid representative.