Item	Details
Prior Confirmation	Prior configuration in MotionBoard is required. For the latest setup instructions, please check the manual provided by MotionBoard. Configuring Single Sign-On via SAML Integration (Creating a SAML Authentication Domain)
Name ID	〇	Email address
		Custom attribute　Note: For how to configure a custom attribute, click here
SP-side Configuration	〇	Configured by the administrator
		Request configuration from the SP
Provisioning		Provisioning via API supported (account management possible in TrustLogin)
	〇	SAML JIT provisioning supported (account management possible in TrustLogin; user deletion not supported) Note: For setup instructions when provisioning is not required, click here
		None (accounts are created in each system)
Access Method	〇	SP-Initiated SSO
	〇	IdP-Initiated SSO
Verified Operation by Device	〇	PC - Browser
	ー	PC - Desktop App
	〇	iOS - Standard Browser (Safari)
	〇	iOS - TrustLogin Mobile App In-App Browser
	ー	iOS - Native App
	〇	Android - Standard Browser (Chrome)
	〇	Android - TrustLogin Mobile App In-App Browser
	ー	Android - Native App

Note: This manual explains the setup steps for single sign-on via SAML integration when creating a SAML authentication domain in MotionBoard.
Note: If you are using MotionBoard Cloud, or if your contracted license is a user license, in addition to registering the user you must also add them as a named user. While it is possible to create a user in MotionBoard via SAML JIT, the user will not be able to log in unless they are added as a named user (for details, click here). For this reason, rather than creating users via SAML JIT, this manual describes the procedure in which the administrator creates the user and adds them as a named user in MotionBoard in advance.
Note: If you are using the on-premises version and do not need to add named users, steps 8 through 12 of "MotionBoard Configuration" in this manual are not required.

Preparation

① Add a Custom Attribute to User Information

Add the "MotionBoard username" as a custom attribute in TrustLogin member information. The attribute name for the custom attribute can be anything you choose.

[TrustLogin Custom Attribute Configuration Example]


[MotionBoard User Information Screen]

Please refer to the following pages for instructions on how to configure custom attributes.

Custom Attribute Setup (Individual Registration)

Custom Attribute Setup (Bulk Registration)

② Create a Group and Assign Members

Create a group to map to a MotionBoard role group and assign members to it.
(If an existing group can be used for this purpose, an existing group is fine.)

Please refer to the following page for how to create a group and assign members.
Registering a Group

[Configuration Example]

• Create an "Administrator" group and assign members of the MotionBoard "Administrator" role
• Create a "General User" group and assign members of the MotionBoard "General User" role

With this configuration, when a user belonging to the "Administrator" group logs in to MotionBoard via SAML, the "Administrator" role is automatically assigned. Users who do not belong to a configured group will not be assigned a MotionBoard role and will not be able to use or view its features.

TrustLogin Admin Page Configuration

1. Log in to TrustLogin here, open the "Admin Page > App" menu, and click the "Register SAML App" button at the top right of the screen.
   
   
   
2. Configure the "Application Name" and "Icon" (optional).
   
   
   
3. Make a note of the "Identity Provider URL" under "Identity Provider Information", and download the certificate from "Download Certificate".
   
   
   
4. Configure each item under "Service Provider Settings" as follows. Note that the settings differ between the cloud version and the on-premises version.
   
   [For customers using the cloud version]
   

   Login URL	https://cloud.motionboard.jp/motionboard/sso/saml?tenant=[Tenant ID]
   Value for Name ID	Select "Member" - "email" (leave as default)
   Entity ID	https://cloud.motionboard.jp/motionboard/
   Name ID Format	Select "emailAddress"
   ACS URL to Service	https://cloud.motionboard.jp/motionboard/sso/saml/callback

   
   [For customers using the on-premises version]
   

   Login URL	・If you do not hold a multi-tenant license http://[Web server name or IP address]:8787/motionboard/sso/saml ・If you hold a multi-tenant license http://[Web server name or IP address]:8787/motionboard/sso/saml?tenant=[Tenant ID]
   Value for Name ID	Select "Member" - "email" (leave as default)
   Entity ID	http://[Web server name or IP address]:8787/motionboard/
   Name ID Format	Select "emailAddress"
   ACS URL to Service	http://[Web server name or IP address]:8787/motionboard/sso/saml/callback

   
   
   
   
5. Click the "Specify Custom Attribute" button in "SAML Attribute Settings", then add a row (attribute) using the "Add SAML Attribute" button. Configure as follows. For the group attribute value, select a group name from the dropdown; you can add multiple entries using the "＋" mark on the right.
   

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Name	Attribute Type	Attribute Name		Attribute Value
   Value ① below	Unspecified	Value ① below	Custom Attribute	The attribute name you configured
   Value ② below	Unspecified	Value ② below	Group	Select the group name you configured and add all of them using the "＋" button

   　
   ①: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
   ②: http://schemas.xmlsoap.org/claims/Group
   
   
   
   
6. Save by clicking the "Register" button.

MotionBoard Configuration

1. Log in to MotionBoard with an administrator account and open "System Settings > Connections/Authentication > Authentication".
   
   
   
2. Click "Create New".
   
   
   
3. Enter any name you like for the external authentication name, set the authentication destination type to "SAML", and click "Create New".
   
   
   
4. Click "Create New" under Domain Settings.
   
   
   
5. Confirm that "saml" is displayed as the Domain ID, then click "Create New".
   
   
   
6. Open "Connections/Authentication > Single Sign-On".
   
   
   
7. Configure the following items and click "Save".
   

   SAML Integration	Check the box
   Target URL	The "Identity Provider URL" you noted down from TrustLogin
   Certificate	Convert the file extension of the "certificate" downloaded from TrustLogin to .crt and upload it
   Add User	Check the box
   Link User and Group	Check the box
   Domain Mapping	Select the "saml" domain Enter the domain name to map in the input field. If you specify "*" in the input field, all values that are not mapped to any domain will be subject to mapping. Select "Add" as the application method

   
   
   
   
8. Open "User > User".
   
   
   
9. Select the "saml" domain, click "Create New", and add a SAML authentication user. The "User ID" must be set to the TrustLogin email address. There is no need to configure the group or role, as these are synchronized via SAML JIT at login.
   
   
   
10. Open "User > Named User".
    
    
    
11. Select the "saml" domain, then drag and drop the users to allow SAML authentication for from the user list shown on the left to the named user list on the right.
    
    
    
12. Confirm that the user has been added to the named user list on the right in the format "UserID@saml", then click "Save".
    
    
    
13. Open "User > Group".
    
    
    
14. Select the "saml" domain, click "Create New", and add a group. The "Group ID" must be the same as the group name in TrustLogin. Configure the corresponding role, then finally click "Add".
    
    
    
15. Repeat step 9 to add groups that map to the groups you configured in TrustLogin.
    

TrustLogin User Configuration

① When a User Adds the App via My Page

1. Click the "Add App" button on "My Page".
2. On the "App Registration" screen, select the custom SAML app you created, and click the "Next" button at the top right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.
4. Click the app on "My Page" or in the browser extension and confirm that login succeeds.

② When an Administrator Adds a Member

1. Search for and click the custom SAML app you created in the "Admin Page > App" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.