How to Configure SAML Authentication for Questetra BPM Suite

Item

Details

Pre-check

  • Pre-configuration is required in Questetra BPM Suite.

  • You must create an account in Questetra BPM Suite using the same email address as your TrustLogin account.

  • For the latest configuration steps, please refer to the manual provided by Questetra BPM Suite.

Name ID

Email address

Custom attribute Note: For how to configure custom attributes, see here

SP Configuration

Configured by the Administrator

Request SP to configure

Provisioning

API-based Provisioning supported (Account management available in TrustLogin)

SAML JITProvisioning supported (Account management available in TrustLogin; user deletion not available)

None (accounts created in each system)

Access Method

SP-Initiated SSO

IdP-Initiated SSO

Device Compatibility

PC - Browser

PC - Desktop App

iOS - Default Browser (Safari)

iOS - TrustLogin Mobile App In-App Browser

iOS - Native App

Android - Default Browser (Chrome)

Android - TrustLogin Mobile App In-App Browser

Android - Native App

TrustLogin Admin Page Settings

  1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
    01.png

  2. Search on the "Register Company App" screen and select "Questetra BPM Suite (SAML)".
    Questetra BPM Suite 05.png

  3. Note the values for "Identity Provider URL" and "Issuer / Entity ID" under "Identity Provider Information," and download the certificate using the "Get Certificate" button.

    03.png

    Now, switch to the configuration on the Questetra BPM Suite side.

    Do not click the "Register" button yet — open Questetra BPM Suite in a separate window.

Questetra BPM Suite Settings

  1. Log in to Questetra BPM Suite, click your name in the upper right, and open "System Settings."
    Questetra BPM Suite 01.png

  2. Select SSO (SAML), and configure the IdP settings as follows.
    Enable Single Sign-On Check this box
    Disable Password Login

    Check this box if you want to disable login with a password

    Note: We recommend checking this box only after confirming that SAML authentication succeeds.

    Entity ID The "Issuer / Entity ID" you noted from TrustLogin
    Login Page URL The "Identity Provider URL" you noted from TrustLogin
    Logout Page URL Leave blank
    NameID Format unspecified
    Digest Algorithm SHA-256
    Credential Validity Period Any period
    Certificate Copy and paste the contents of the certificate you noted from TrustLogin

    Questetra BPM Suite 02.png

  3. Note the following information under "SP Information," then click "Save."
    Entity ID Copy and note down
    ACS URL Copy and note down
    Single Logout Service URL Copy and note down

    Questetra BPM Suite 03.png

Return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

  1. Configure the "Service Provider Settings" as follows.
    Entity ID The "Entity ID" you noted from Questetra BPM Suite
    ACS URL for the Service The "ACS URL" you noted from Questetra BPM Suite
    Logout URL

    The "Single Logout Service URL" you noted from Questetra BPM Suite

    Note: Single logout is planned as a future feature but is not yet implemented, so it does not currently work.


    Questetra BPM Suite 04.png

  2. Click the "Register" button to save.

TrustLogin User Settings

① When a User Adds the App from My Page

  1. Click the "Add App" button on "My Page."
  2. On the "Register App" screen, select "Questetra BPM Suite (SAML)" and click the "Next" button in the upper right of the screen.
  3. If you want to change the "Display Name," enter it and click the "Register" button.

② When an Administrator Adds Members

  1. Search for and click the "Questetra BPM Suite (SAML)" app in the "Admin Page > App" menu.
  2. Click "Add Member," select the user to add from the member list, and click the "Register" button to add them.

How to Configure SAML Authentication for Questetra BPM Suite

Item

Details

Pre-check

  • Pre-configuration is required in Questetra BPM Suite.

  • You must create an account in Questetra BPM Suite using the same email address as your TrustLogin account.

  • For the latest configuration steps, please refer to the manual provided by Questetra BPM Suite.

Name ID

Email address

Custom attribute Note: For how to configure custom attributes, see here

SP Configuration

Configured by the Administrator

Request SP to configure

Provisioning

API-based Provisioning supported (Account management available in TrustLogin)

SAML JITProvisioning supported (Account management available in TrustLogin; user deletion not available)

None (accounts created in each system)

Access Method

SP-Initiated SSO

IdP-Initiated SSO

Device Compatibility

PC - Browser

PC - Desktop App

iOS - Default Browser (Safari)

iOS - TrustLogin Mobile App In-App Browser

iOS - Native App

Android - Default Browser (Chrome)

Android - TrustLogin Mobile App In-App Browser

Android - Native App

TrustLogin Admin Page Settings

  1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
    01.png

  2. Search on the "Register Company App" screen and select "Questetra BPM Suite (SAML)".
    Questetra BPM Suite 05.png

  3. Note the values for "Identity Provider URL" and "Issuer / Entity ID" under "Identity Provider Information," and download the certificate using the "Get Certificate" button.

    03.png

    Now, switch to the configuration on the Questetra BPM Suite side.

    Do not click the "Register" button yet — open Questetra BPM Suite in a separate window.

Questetra BPM Suite Settings

  1. Log in to Questetra BPM Suite, click your name in the upper right, and open "System Settings."
    Questetra BPM Suite 01.png

  2. Select SSO (SAML), and configure the IdP settings as follows.
    Enable Single Sign-On Check this box
    Disable Password Login

    Check this box if you want to disable login with a password

    Note: We recommend checking this box only after confirming that SAML authentication succeeds.

    Entity ID The "Issuer / Entity ID" you noted from TrustLogin
    Login Page URL The "Identity Provider URL" you noted from TrustLogin
    Logout Page URL Leave blank
    NameID Format unspecified
    Digest Algorithm SHA-256
    Credential Validity Period Any period
    Certificate Copy and paste the contents of the certificate you noted from TrustLogin

    Questetra BPM Suite 02.png

  3. Note the following information under "SP Information," then click "Save."
    Entity ID Copy and note down
    ACS URL Copy and note down
    Single Logout Service URL Copy and note down

    Questetra BPM Suite 03.png

Return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

  1. Configure the "Service Provider Settings" as follows.
    Entity ID The "Entity ID" you noted from Questetra BPM Suite
    ACS URL for the Service The "ACS URL" you noted from Questetra BPM Suite
    Logout URL

    The "Single Logout Service URL" you noted from Questetra BPM Suite

    Note: Single logout is planned as a future feature but is not yet implemented, so it does not currently work.


    Questetra BPM Suite 04.png

  2. Click the "Register" button to save.

TrustLogin User Settings

① When a User Adds the App from My Page

  1. Click the "Add App" button on "My Page."
  2. On the "Register App" screen, select "Questetra BPM Suite (SAML)" and click the "Next" button in the upper right of the screen.
  3. If you want to change the "Display Name," enter it and click the "Register" button.

② When an Administrator Adds Members

  1. Search for and click the "Questetra BPM Suite (SAML)" app in the "Admin Page > App" menu.
  2. Click "Add Member," select the user to add from the member list, and click the "Register" button to add them.