Item	Details
Prior Confirmation	Prior configuration in MongoDB is required. Applying SAML requires that a domain be owned and verified. For the latest setup instructions, please check the manual provided by MongoDB.
Name ID	〇	Email address
		Custom attribute　Note: For instructions on how to configure a custom attribute, click here
SP-side Configuration	〇	Configured by the administrator
		Request configuration from the SP
Provisioning		API-based Provisioning supported (account management available in TrustLogin)
	〇	SAML JIT Provisioning supported (account management available in TrustLogin; user deletion not supported)
		None (accounts created in each system)
Access Method	〇	SP-Initiated SSO
	〇	IdP-Initiated SSO
Verified Operation by Device	〇	PC - Browser
	ー	PC - Desktop App
	〇	iOS - Standard Browser (Safari)
	〇	iOS - TrustLogin Mobile App In-App Browser
	ー	iOS - Native App
	〇	Android - Standard Browser (Chrome)
	〇	Android - TrustLogin Mobile App In-App Browser
	ー	Android - Native App
SAML Authentication Scope	ー	Enabled for all users (SAML authentication only)
	〇	Other: Enabled only for users whose domain has been verified with the SP (SAML authentication only)
Notes	None in particular.

Table of Contents: Prerequisites (Group Configuration in TrustLogin) Prerequisites (Domain Verification in MongoDB) TrustLogin Admin Page Settings MongoDB Settings TrustLogin Admin Page Settings (Continued) TrustLogin User Settings

Prerequisites (Group Configuration in TrustLogin)

To configure role mapping for MongoDB organizations and projects for members belonging to a TrustLogin group, set up the TrustLogin group in advance.

For instructions on how to create a group and assign members, please refer to the following page.
Register a Group

Prerequisites (Domain Verification in MongoDB)

1. Open the admin page for your MongoDB organization, and click "Open Federation Management App" under "Federated Authentication Settings".
   
   
2. Open the "Domains" menu and click "Add Domains".
   
   
   
3. Enter the domain name to be used for SSO in "Display Name" and "Domain Name", and select "DNS Record" as the domain verification method. Click "Continue" to proceed.
   
   
4. Copy the TXT record displayed under "① Get your TXT Record", and click "Continue".
   
   
   
5. Add the obtained TXT record to your domain's DNS records.
   For instructions on how to configure your domain's DNS records, please refer to the help documentation provided by your domain registrar.
   
   After adding the DNS record, click "Actions" > "VERIFY" for the domain. Once "Status" changes from "UNVERIFIED" to "VERIFIED", domain verification is complete.
   
   DNS record updates may take up to approximately 72 hours to propagate. If verification does not complete right away, please wait a while and try "VERIFY" again.
   
   
   

Once domain verification is complete, resume the configuration from the next step.

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register SAML App" button in the upper right of the screen.
   
   
   
2. Configure the "Application Name" and "Icon" (optional).
   
   
   

3. Note down the values for "IdP URL" and "Issuer/Entity ID" under "Identity Provider Information", and download the certificate using the "Get Certificate" button.
   
   
   

4. Click the "Specify Custom Attribute" button in "SAML Attribute Settings", then add a row (attribute) using the "Add SAML Attribute" button and configure it as follows.
   

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Name	Attribute Type	Attribute Name		Attribute Value
   firstName	Basic	firstName	Member	Member's First Name
   lastName	Basic	lastName	Member	Member's Last Name
   memberOf	Basic	memberOf	Group	Select the configured group name and add it using the "＋" button

   
   
   
   

Now, switch to configuring MongoDB.
Do not click the "Register" button yet — open MongoDB in a separate window.

MongoDB Settings

1. Open the admin page for your MongoDB organization, and click "Open Federation Management App" under "Federated Authentication Settings".
   
   
   
2. [IdP Configuration]
   Open the "Identity Providers" menu and click "Set Up Identity Provider".
   
   
   
3. Select "Workforce Identity Federation" and click "Continue" to proceed.
   
   
   
4. Configure each item as follows, then click "Continue" to proceed.
   

   Configuration Name	Any name of your choice
   Issuer URI	The "Issuer/Entity ID" obtained from TrustLogin
   Single Sign-On URL	The "IdP URL" obtained from TrustLogin
   Identity Provider Signature Certificate	Click "Alternatively, paste the contents of the certificate directly." and paste the contents of the "Certificate" obtained from TrustLogin

   
   
   
   
5. Click "Download metadata" to obtain the metadata, then click "Save and Finish".
   
   
   
6. Click "ASSOCIATE DOMAINS".
   
   
   
7. Select the target domain and click the "Submit" button.
   
   
   
8. Click "Manage" in the upper right and select "Activate Identity Provider".
   
   
   
9. Click "Activate".
   
   
   
10. Open the "Linked Organizations" menu and click "CONFIGURE ACCESS" for the target organization.
    
    
    
11. Click "Connect Identity Provider".
    
    
    
12. Select the IdP configuration you set up and click "Connect".
    
    
    
13. [Configuration ① within "CONFIGURE ACCESS" - Default Role]
    "Default Role" lets you configure the role assigned to a user when a new user is created.
    However, if the role mapping configured next applies, it takes priority.
    
    
    
14. [Configuration ② within "CONFIGURE ACCESS" - Role Mapping Settings]
    Click "Manage Role Mappings".
    
    
    
15. Click "Create A Role Mapping".
    
    
    
16. Enter the TrustLogin group name in "Enter Group Name", and select the organization role to assign to members of that group. Click the "Next" button to proceed.
    
    
    
17. Select the project role to assign, then click the "Next" button to proceed.
    
    
    
18. Review the details and save by clicking the "Finish" button.
    
    
19. Repeat steps 19 through 22 to configure settings for each group you want to map.
    
    
20. [Configuration ③ within "CONFIGURE ACCESS" - Domain Restriction for Invited Users]
    Turning on "Restrict Access by Domain" allows you to invite to the organization only new users with an email address on a verified domain.
    However, if a user already added to the organization does not have an email address on a verified domain, their access to the organization is not restricted.
    

Now return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

1. Using the "Select Metadata" button in "Service Provider Settings", upload the "metadata" obtained from MongoDB.
   
   
   
2. Save by clicking the "Register" button.

TrustLogin User Settings

① When a User Adds the App via My Page

1. Click the "Add App" button on "My Page".
2. On the "Register App" screen, select the custom SAML app you created, and click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.

② When an Administrator Adds a Member

1. Search for and click the custom SAML app you created in the "Admin Page > App" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.