SAML SSO Integration Guide

​

Overview

This guide is for IT administrators who connect a SAML 2.0 identity provider to Legora’s global authentication. Members then sign in to Legora with their work credentials. The same steps apply when you select SAML, ADFS, or PingFederate in Legora. Microsoft Entra ID on Legora’s global authentication uses OpenID Connect. See Integration Overview - Entra ID Single Sign-on.

​

How it works

You create a SAML application in your identity provider and give it Legora’s service provider details. You then enter your identity provider’s details in Legora. That exchange is what lets Legora trust the sign-in.

​

Prerequisites

You need both of these before you start:

• Administrator access to your organization’s SAML 2.0 identity provider.
• Manage authentication security in the Legora organization.

​

Set up the connection

Do the identity provider steps first, then the Legora steps. The service provider values are the same for every organization on Legora’s global authentication.

​

Create the SAML application

Start in your identity provider’s administration console.

1. Create a new SAML 2.0 application for Legora.
2. If the organization already has a Legora SAML app, keep that app and create this one beside it. The migration section below says when that applies.

​

Enter Legora’s service provider details

Copy these values into the new application. They do not change by region.

• Entity ID, Audience URI, or Identifier: https://sso.legora.com
• ACS URL, Single Sign-On URL, or Reply URL: https://sso.legora.com/api/oauth/saml

https://sso.legora.com is a sign-in service, not a website. Opening that root address shows 404 Not Found by design. Use the full ACS URL. After you create the connection, ACS URL on the connection shows the same reply URL. Entity ID on the connection shows your identity provider’s identifier. Enter https://sso.legora.com in the identity provider as Legora’s Entity ID. Legora requires an email claim. given_name and family_name are recommended. Map your identity provider’s attributes to those names.

​

Add the identity provider in Legora

Enter your identity provider’s details so Legora can send members to the right sign-in page.

1. From your name on the menu, select Settings > People > Authentication.
2. Under SSO, select Add, then choose SAML, ADFS, or PingFederate.
3. Enter a Display Name. Members see this name on the sign-in screen.
4. Enter your identity provider’s details. Use one of these:
   • Metadata URL: Legora fetches the sign-in endpoint and certificate from this address. This is the usual choice.
   • Or enter your identity provider’s Entity ID, Sign-In Endpoint URL, and Signing Certificate (PEM).
5. Select Create connection. Legora opens the new connection.

Edit on a SAML connection changes the display name only. To change the metadata, create a new connection.

​

Test and turn on the connection

Confirm the connection before members rely on it.

1. In your identity provider, assign a test user to the Legora SAML application.
2. In Legora, open the connection and select Test connection. A sign-in window opens.
3. Sign in with the test user. You should return to Legora.
4. Turn on Status so members can sign in with this connection.

If the test fails, compare the ACS URL and Entity ID in your identity provider with the values in the previous steps. Also confirm the assertion includes email.

​

Migrating to Legora’s global authentication

Use this section only when the organization already has a SAML app for Legora and you are moving that organization to Legora’s global authentication. A first-time setup is finished after you turn on Status. A SAML app is tied to the service provider Entity ID. You can’t point the existing app at Legora’s global authentication. Create a new SAML app with the values above. Leave the existing app unchanged until the migration is complete. To test during the migration, from your name on the menu, select Settings > People > Authentication migration. Run the connection test and confirm it shows Passed. Legora does not support more than one SAML app in the same Microsoft Entra tenant. Move those connections to OpenID Connect. See Integration Overview - Entra ID Single Sign-on. For integration callback URLs, firewall rules, and the rest of the move, see IT Admin guide: Legora’s global authentication.

​

Troubleshooting

Start with the assertion and the two Legora URLs.

​

Sign-in fails or the user is not found

Legora requires an email claim, and it rejects an assertion that marks the email as unverified. Confirm the identity provider sends email, and that given_name and family_name use those names when you send them. Also confirm the test user is assigned to the application.

​

The reply URL or entity ID is rejected

The ACS URL and Entity ID in your identity provider must match the values in this guide exactly. Use https://sso.legora.com with no trailing slash, and use the full ACS URL https://sso.legora.com/api/oauth/saml. If those checks don’t fix it, contact support@legora.com.