Item	Details
Pre-check	Prior configuration in Celonis is required. Please refer to the manual provided by Celonis for the latest configuration steps.
Name ID	〇	Email address
		Custom attribute　Note: For how to configure custom attributes, see here
SP-side Configuration	〇	Configured by the administrator
		Request configuration from the SP
Provisioning		API-based Provisioning supported (account management available in TrustLogin)
	〇	SAML JIT provisioning supported (account management available in TrustLogin; user deletion not supported) Note: For setup instructions when provisioning is not required, see here
		None (accounts created in each system)
Access Method	〇	SP-Initiated SSO
	〇	IdP-Initiated SSO
Verified Operation by Device	〇	PC - Browser
	ー	PC - Desktop App
	※	iOS - Standard Browser (Safari)
	※	iOS - TrustLogin Mobile App In-App Browser
	ー	iOS - Native App
	※	Android - Standard Browser (Chrome)
	※	Android - TrustLogin Mobile App In-App Browser
	ー	Android - Native App

Note: We have confirmed that SAML SSO is possible on various mobile browsers; however, since the Free Plan we tested does not support mobile use, we have not performed actual operation verification.

Prerequisites

Complete this preparation only if you want to automatically assign users to groups.

Create groups in TrustLogin with the same names as the groups in Celonis, and assign members to them.
Please refer to the following page for how to create groups and assign members.
Register a Group

[Configuration Example]

• Create an "Admin" group in Celonis and assign it the "Admin" team role
• Create a "Member" group in Celonis and assign it the "Member" team role
  
  

In TrustLogin as well, create groups with the same names, "Admin" and "Member", and assign members to them.


With this configuration, when a user belonging to the "Admin" group logs in to Celonis via SAML, they will automatically belong to the "Admin" group and be assigned the administrator role.

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register SAML App" button at the top right of the screen.
   
   
   
2. Register the "Application Name" and "Icon" (optional).
   
   
   
3. Download the metadata from the "Download Metadata" button in the "Identity Provider Information" section.
   

Now, switch to configuring Celonis.
Do not click the "Register" button yet — open Celonis in a separate window.

Celonis Configuration

1. Open "Admin & Settings > Settings" and turn OFF "Enable SCIM".
   
   
   
2. Open "Admin & Settings > Single Sign-On" and click "Add SSO Provider > SAML".
   
   
   
3. Set any SAML configuration name you like (e.g., TrustLogin) in "General Settings > Name".
   
   
   
4. Open the "Metadata" tab, upload the metadata obtained from TrustLogin, and save by clicking "Save".
   
   
   
5. Click "Download SP Metadata" to download the metadata.
   
   
   
6. Open the "JIT Configuration" tab, check "Enable Just-in-Time (JIT) Provisioning", and close the message that appears.
   
   
   
   
7. Configure each item as follows and save by clicking "Save".
   

   First name attribute	Enter "Firstname"
   Last name attribute	Enter "Lastname"
   Group attribute	Note: Only if you want to automatically assign users to groups Enter "Group" and check "Automatically assign a group to the user"

   
   When automatically assigning users to groups
   
   
   When not automatically assigning users to groups
   

Now return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

1. Upload the metadata downloaded from Celonis to the metadata field in "Service Provider Settings".
   
   
   
2. Click the "Specify Custom Attribute" button in "SAML Attribute Settings", then add rows (attributes) using the "Add SAML Attribute" button. Configure each row as follows.
   
   Configure the Group row only if you want to automatically assign users to groups.
   For the group attribute value, select the group name from the dropdown; you can add multiple groups using the "＋" mark on the right.
   

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Name	Attribute Type	Attribute Name		Attribute Value
   email	Basic	email	Member	Member - Email Address
   Firstname	Basic	Firstname	Member	Member - First Name
   Lastname	Basic	Lastname	Member	Member - Last Name
   Group	Basic	Group	Group	Select the configured group name and add all of them using the "＋" button

   
   When automatically assigning users to groups
   
   
   When not automatically assigning users to groups
   
   
   
3. Save by clicking the "Register" button.
   
   

TrustLogin User Settings

① When a User Adds the App via My Page

1. Click the "Add App" button on "My Page".
2. On the "App Registration" screen, select the custom SAML app you created, and click the "Next" button at the top right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.

②When an Administrator Adds a Member

1. Search for and click the custom SAML app you created in the "Admin Page > App" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.

Now return to Celonis.

Celonis Configuration (Enable SSO)

Check the radio button for the SSO provider configuration you created, and click "Activate".
At this point, the administrator and all team users will be forcibly logged out. The administrator will also see an error screen and will need to log in again.

First Login for Newly Created Users

When a user not yet registered in Celonis performs SSO via SAML JIT, an invitation email to join the team will be sent.
Approving the invitation email completes the login to the team.