Set up SAML SSO with another identity provider

This guide connects Dew to any identity provider that supports SAML 2.0, so your users sign in to Dew with their account there. You will create a SAML app in your identity provider, exchange URLs and a signing certificate with Dew, and assign the app to your users. For Entra ID, Okta or Google Workspace, follow their own guides instead: Entra ID, Okta, Google Workspace.

You need:

• A Dew administrator account.
• A Pro or Enterprise plan.
• An administrator account in your identity provider that can create SAML apps.

---

1. Start the integration in Dew

In Dew, go to People → SSO and click Add SSO connection to open the setup wizard.

Identity provider: select Other provider.

Connection name: enter the name of your identity provider (for example OneLogin). Dew shows it on the SSO page.

Email domains: add every email domain your identity provider’s users sign in with (for example example.com). Users signing in with these domains will be sent to your identity provider.

Click Next.

Copy the Dew URLs. Leave the wizard open. Two values on this screen go into your identity provider in the next step:

Dew field	Looks like
Service Provider Consumer URL (ACS)	https://dew.example.com/api/sso/<connection ID>/acs
Service Provider entity ID	https://dew.example.com/saml/sp/<connection ID>

Both use your primary Dew domain, even when users open Dew on another domain.

---

2. Create the Dew app in your identity provider

In your identity provider’s admin console, create a new SAML 2.0 app (sometimes called a custom or generic SAML app) and name it, for example Dew.

Fill in the app’s SAML settings using values from the Dew wizard tab. Your identity provider’s field names may differ:

Identity provider setting	Value
ACS URL, Single sign-on URL or Reply URL	Service Provider Consumer URL (ACS) from the Dew wizard
Audience, SP Entity ID or Identifier	Service Provider entity ID from the Dew wizard
Name ID format	Email address
Name ID	The user’s email address

If your identity provider can import service provider metadata, you can give it https://dew.example.com/api/sso/<connection ID>/sp-metadata instead, with the same connection ID as the two URLs.

Dew uses the Name ID as the user’s email address in Dew. It must hold the address your users type on the Dew sign-in page. If the Name ID can’t be an email address, Dew reads the email from an email or mail attribute instead.

Attributes. Add two attributes so Dew can show each user’s name; without them, Dew shows the user’s email address as their name:

Attribute name	Value
firstName	The user’s first name
lastName	The user’s last name

Signing. Have your identity provider sign the assertion or the response. Dew rejects responses that aren’t signed. Dew doesn’t sign its sign-in requests, so turn off any setting that requires signed requests.

Sign-in from the identity provider’s dashboard. Dew only accepts sign-ins that start on the Dew sign-in page, so a dashboard tile that opens the app directly fails. Hide the app’s tile, or point it at your Dew sign-in page, for example https://dew.example.com/login.

Save the app. Three values from your identity provider go into Dew in the next part. Keep this tab open:

• The single sign-on URL (sometimes called SSO URL, Login URL or SAML endpoint)
• The identity provider entity ID (sometimes called Issuer)
• The signing certificate: download it as a .pem, .cer, .crt or .cert file

---

3. Finish the integration in Dew

Switch back to the Dew wizard and fill in the identity provider fields using the values from your identity provider:

Dew field	Identity provider value
Single Sign-On URL	Single sign-on URL
Identity Provider entity ID	Identity provider entity ID (Issuer)
Identity Provider certificate	Drop the downloaded certificate file into the upload area
User ID attribute	Leave empty

With User ID attribute empty, Dew matches people by email address. If your identity provider sends each user’s permanent ID in an attribute, enter that attribute’s name to keep people on the same Dew account when their email address changes. Every sign-in must then include it.

Click Save. The connection now appears on the SSO page with a green dot.

---

4. Give new users access

Dew creates an account at a user’s first sign-in only when a Dew domain is open to them: the domain’s access list includes Everyone, or a group that includes everyone at the user’s email domain. Otherwise Dew refuses the sign-in and creates no account.

The first domain you set up in Dew gives Everyone access automatically, so on a new install new users can sign in without any changes here. To check, open Settings → Domains, click ⋮ on the domain and choose Manage access. People with access lists everyone and every group that can use the domain.

To limit Dew to users at one email domain:

1. Open People → Groups and click New group. Enter a name and click Create group.
2. On the group’s page, click Add by email domain, enter the email domain (for example example.com), click Preview and confirm.
3. On the Domains card, click Add domain and choose the Dew domain.
4. Open the domain’s Manage access, remove Everyone and click Remove access.

Access changes apply straight away, also for users who already have an account.

---

5. Assign users in your identity provider

Most identity providers only let users and groups assigned to an app sign in to it. Assign the Dew app to the users or groups who should use Dew.

---

6. Test the sign-in

Open the Dew sign-in page in a private or incognito window and enter the email address of an assigned user. You should be sent to your identity provider, asked to sign in, and returned to Dew signed in.

Test with an account other than the owner, the account created when Dew was set up and marked Owner in the Role column of the users list. The owner always signs in with their Dew password, so you can still get in if your identity provider stops working.

To stop users in your email domains from signing in with a local Dew password, open People → SSO and select SSO required in the Enforcement card. Leave it on SSO optional until a test sign-in works.

---

Replace the signing certificate

Replace your identity provider’s signing certificate before it expires. The connection card in Dew lists each certificate with its expiry date, which turns amber 30 days before. Dew keeps trusting the current certificate until you remove it, so sign-in keeps working while you switch.

1. In your identity provider, create a new signing certificate for the Dew app.
2. Download the new certificate as a .pem, .cer, .crt or .cert file.
3. In Dew, choose Update certificate in the connection’s menu, drop the downloaded file into New certificate and click Save. The connection card now lists Certificate and Previous certificate.
4. In your identity provider, make the new certificate the one it signs with.
5. Test the sign-in (part 6). Then in Dew, click Remove next to Previous certificate and confirm with Remove certificate. If you leave it, Dew removes it when it expires.

---

Troubleshooting

Most refused sign-ins are listed in the Recent sign-in problems card on People → SSO, with the reason. Errors your identity provider shows never reach Dew, and a sign-in that didn’t start on the Dew sign-in page shows its message only on the sign-in page. Some problems show a technical detail below the reason.

What you see	What to do
“The identity provider refused the sign-in”	Your identity provider refused the user, most often because they aren’t assigned to the app. See part 5.
The sign-in page shows “To sign in with single sign-on, start from the Dew sign-in page”	The user opened Dew from a dashboard tile. Have them open the Dew sign-in page directly, or point the tile at it (part 2).
“The identity provider’s response was rejected” with assertion audience does not match SP entity ID	The audience or SP entity ID in your identity provider doesn’t match Service Provider entity ID in Dew. Copy it again from View details on the Dew connection.
“The identity provider’s response was rejected” with Could not verify certificate against trusted certs	The certificate in Dew isn’t the one your identity provider signs with. Download it again and upload it with Update certificate in the connection’s menu.
“The identity provider’s response was rejected” with another detail	Check the single sign-on URL, entity ID and certificate in Dew against your identity provider, and that the assertion or response is signed.
“The identity provider didn’t send an email address”	Set the Name ID to the user’s email address, or send an email attribute (part 2).
“The identity provider didn’t send the user ID attribute”	Send the attribute named in User ID attribute, or clear it with Edit user ID attribute in the connection’s menu.
“The user signed in to the identity provider with a different email address”	The user signed in to your identity provider as someone else, or the Name ID holds a different address from the one they typed.
“No account was created because no domain is open to everyone or to the user’s email domain.”	Add Everyone, or a group for that email domain, to a domain’s Manage access. See part 4.
“The account has no domain access”	Give the user a domain, directly or through a group.

For more detail, open System → System → Error logs in Dew and filter by SSO. When contacting support, include the problem shown in Recent sign-in problems.