Set up single sign-on (SSO) using SAML 2.0

1. In Security, select Authentication.

2. Under New single sign-on (SSO) on the Authentication settings page, select Manage SSO settings.

3. On the Single sign-on page, select SAML 2.0.

4. Under Claim your email domains, select Claim domains or Edit claimed domains and identify the email domains that your organization uses. This allows you to recognize and redirect users to your IdP when they sign in through your claimed email domains.

1. In a different browser tab, go to your IdP portal to register a new application or to select an existing one on your domain.

   • In Assertion Consumer Service URL or Application Callback URL, add "https://id.blackbaud.com/bbid.onmicrosoft.com/B2C_1A_TrustFrameworkBase/samlp/sso/assertionconsumer" as the redirect URL. This value doesn't need to be updated to a different relying party policy.

     Warning: For an existing application, don't overwrite existing redirect URLs. If you remove the redirect URLs when you add the provided redirect URL, it can disrupt your existing SSO connection.

   • In Audience or Entity, enter "https://id.blackbaud.com/bbid.onmicrosoft.com/B2C_1A_TrustFrameworkBase" as the entity ID. This value doesn't need to be updated to a different relying party policy.

2. Return to Blackbaud's the Authentication settings page, and under Configure your connection, select Get started or Edit connection.

3. Under Enter your connection details on the Configure SAML 2.0 connection screen, enter details for your organization's connection.

   1. In the Connection name field, enter a name to uniquely identity your connection. If you opt to skip Blackbaud's sign-in page, you can use this name for the SSO shortcut.

   2. In the Metadata type field, select whether to provide a URL for the location of your SAML connection's metadata or to provide the actual metadata in XML format.

      • If you select "Metadata URL," enter the URL in the Metadata URL field where you store your metadata in XML format.

      • If you select "Metadata XML," paste the metadata directly in the Metadata field.

   3. To sign requests from Blackbaud's platform to your IdP with a password, select Sign SAML requests and complete the options that appear. This ensures that AuthnRequests are signed as long as you provide a Personal Information Exchange (.pfx) file.

      • For a new connection:

        1. Select Choose file and then select the .pfx file for your SAML 2.0 connection.

           Tip: The .pfx certificate file includes a password to sign requests from Blackbaud's SSO platform to the IdP and provides a secure, stable connection. The .pfx file is stored securely and isn't accessible to anyone at Blackbaud.

        2. In the Certificate password field, enter the password for your signing certificate.

      • For an existing connection, use the radio buttons to select whether to change the signing certificate and password or to use the existing values.

   4. To add an additional layer of security to the assertion that you send Blackbaud as part of your SAML connection, select Encrypt SAML assertions. This additional security requires no extra effort from you because Blackbaud manages the certificate.

4. Under Confirm how your IdP identifies the following, specify where you store the data that your IdP uses to identify your organization's users. Enter field names or unique identifiers — as attribute names, not friendly names.

   1. In the NameID field, specify where you store the unique IDs that your IdP uses to identify your users. The field for this data varies depending on your IdP, but the values are typically not email addresses or employee IDs. Instead, the values should be unique IDs that your IdP creates to distinguish users across all accounts.

      Warning: We recommend against using email addresses to identify users. If you identify users by email address and need to change a user's email address, then you must re-invite the user at the new email address, which means you lose all history associated with the original one.

   2. In the Email address field, specify where you store user email addresses.

      Note: For successful connections, email addresses must be unique.

   3. In the First name field, specify where you store first names.

   4. In the Last name field, specify where you store last names.

5. Select the checkbox that acknowledges the need to wait before you access the metadata for your SAML connection and test your SSO connection.

   • If you are setting up SSO for the first time, select I acknowledge these settings require 24 hours to take effect.

   • If you are editing an existing SSO connection, select I acknowledge these changes can take up to 30 minutes to take effect.

6. Select Save. A notification will alert you when your SSO connection is ready.

7. On the Authentication settings page under Configure your connection, the View metadata option appears. After your configuration settings take effect, use this option to access an XML document with metadata about your SAML connection and then provide any additional information that your IdP requires to connect to Blackbaud's secure authentication service.

When you save your configuration settings, test mode is turned on automatically. At least one user must successfully sign in using test mode before you can enable your SSO connection.

To verify that your organization can use your IdP to sign in to Blackbaud solutions, select Learn about testing SSO under Test connection. Then copy the URL under Blackbaud ID redirect and test your connection in a private or incognito browser window.

Note: If a consent screen appears in test mode, that means your IdP is configured to require admin approval before users authenticate. This consent screen is for the Blackbaud SSO application and is not requesting new permissions or access. It is seeking read-access to the user information that you already configured as part of your SSO setup. To proceed, follow the instructions on your IdP's consent screen.

When you turn off test mode, an Erase all single sign-on settings option appears under Configure your connection so that you can clear your configuration settings and start over. For example, you can select the option if you decide to use a different connection method or if you need to troubleshoot an issue and start over. The option is no longer available when you turn on SSO, but you can turn off SSO to make it available again.

To complete the connection to your IdP, select Turn on SSO under Turn on. Then on the Connect your SAML 2.0 SSO screen, select Connect with SAML 2.0.

After you turn on SSO, users are redirected to your IdP when they sign in to their Blackbaud IDs with one of your claimed domains. After they authenticate through your IdP, their Blackbaud IDs:

• Automatically redirect them to your organization's login for future sign-ins.

  After users sign in through your organization's login, they are redirected to their Blackbaud profiles unless you edit the redirect URL to specify a Blackbaud solution.

  Tip: Don't forget that if your users use an app in your IdP's portal to connect to Blackbaud solutions, you must configure that app to use the redirect URL for your live connection.

• Use your IdP for password updates, lockouts, and other authentication management.

Note: After you enable SSO, resend any pending invitations.