Set up an SSO connection

Single sign-on (SSO) lets users log in to Lansweeper with the credentials from your identity provider (IdP), instead of a separate Lansweeper password. Lansweeper supports SAML and OIDC connections.

An SSO connection belongs to your Lansweeper account, not to a single site. Once you verify a domain for the connection, every user with an email address on that domain can use SSO to log in to any site they have access to.

Prerequisites

• Administrator access to your identity provider (IdP).
• Ownership of the domain you want to add to the connection. You need to add a DNS TXT record to verify it.

Create an SSO connection

1. Go to Account settings > Single Sign-On.
2. Select Create SSO connection.
3. Choose a connection type: SAML or OIDC. Your identity provider determines which one to use. Most identity providers support at least one.
4. Continue to Connection setup and enter a Name for the connection.

Configure a SAML connection

The Service provider metadata section is read-only. Copy these values into your IdP's configuration:

• Entity ID
• Assertion Consumer Service (ACS) URL
• SingleLogout Service (SLO) URL
• IdP Assertion Consumer Service (ACS) URL: only needed if you enable IdP-initiated SSO.

You can also select Download SP certificate (PEM) to give your IdP a certificate it can use to validate signed requests or encrypt assertions from Lansweeper.

In the Identity provider configuration section, enter the details from your IdP:

1. Enter the Sign in URL from your IdP.
2. Upload your IdP's X509 signing certificate, in PEM or CER format.

To enable IdP-initiated SSO:

1. Add the Assertion Consumer Service (ACS) URL and IdP Assertion Consumer Service (ACS) URL from the Service provider metadata section to your IdP.
2. Turn on Enable IdP-initiated Single Sign-On.

Optionally, configure:

• NameID format: the format Lansweeper includes in the SAML response. Defaults to Persistent.
• Email claim: the claim Lansweeper uses to read the user's email address. Defaults to emailaddress.

Configure an OIDC connection

The Service provider metadata section is read-only:

• Callback URL: configure this in your OIDC provider to complete authentication.

In the Identity provider configuration section, enter the details from your IdP:

1. Enter the Discovery URL for your OIDC provider. This is typically its .well-known/openid-configuration endpoint. Lansweeper uses it to retrieve the rest of the configuration automatically.
2. Enter the Client ID.
3. Enter the Client secret.

Optionally, configure the Email claim: the claim Lansweeper uses to read the user's email address. Defaults to emailaddress.

When you're done, save the connection.

Add and verify a domain

Before anyone can log in with SSO, add and verify at least one domain.

1. In the Single Sign-On view, select Add domain.
2. Enter a domain you own, then select Add. Lansweeper adds the domain and shows a code to verify ownership.
3. Add the code as a TXT record with your DNS provider.
4. Once the record is in place, return to the Single Sign-On view and select Verify domain.

A verified domain still needs to be enabled before users on that domain can log in with SSO. For that, and for managing domains and connection managers, see Manage an SSO connection.

Log in with SSO

Once a domain is verified and enabled, users with an email address on that domain can select Log in with Single Sign-On to log in with your IdP's credentials instead of a Lansweeper password.

Password login remains available for these users unless a site requires SSO.

Next steps

• Manage an SSO connection