How to configure SAML SSO for Sugar

Matthew Marum —  February 14, 2017 — 6 Comments

Many customers want to configure Sugar for Single Sign On (SSO). Well Sugar supports Security Assertion Markup Language (SAML) so this must be easy, right? But the devil is always in the details.

Each SAML identity provider behaves a little differently. Each of these systems has different terminology and methods for configuration and may use different default settings. Some of these important configuration settings can make the difference between a successful SSO implementation and a tire fire. For example, are users provisioned Just-In-Time or will they be provisioned manually? Did you know that Sugar uses the e-mail address as the SAML application username format?

Below are instructions for configuring SAML SSO with a couple of common identity providers.

Okta

One of our Solution Architects, Enrico Simonetti, wrote a good summary of how to configure SAML authentication for Sugar using Okta as the identity provider. Okta is convenient for trying out SSO because they have a developer program you can join. Enrico also covers a few tips and details that can trip up any SAML implementation.

Please visit Enrico’s post called SSO Authentication on SugarCRM with SAML for more details including screen shots and even code examples.

Active Directory Federation Service

The most common system that we get questions about is Microsoft’s Active Directory Federation Service (ADFS). ADFS is pretty complicated so there are several steps that you need to follow to get it done right.

We recently publish a SugarCRM Knowledge Base article called Configuring SSO With Active Directory’s ADFS. It was written by Lars Blockken, one of our Senior Technical Account Managers, and in it he walks you through each of these steps in detail along with screenshots. It will have you up and running on ADFS in no time!

Matthew Marum

Posts

Matt is the Director of Developer Advocacy for SugarCRM. Previously he was an Engineer on Sugar 7 and a Solutions Architect for the OEM program. He is also an avid trail runner, Boston Marathon qualifier and a karaoke aficionado.

6 responses to How to configure SAML SSO for Sugar

  1. 

    Do you know if this will work if implemented on two separate Sugar instances, but using same Active Directory?
    In other words, one company
    one Active Directory
    Two Sugar instances

    • 

      Yes, this will work. You would just treat the 2 Sugar instances as separate applications from Active Directory perspective. It shouldn’t be any different than configuring any other app for single sign on. You would just repeat the steps for both instances. Though if you go through steps listed in that KB article, you will see in step 9 that you will need to make sure your Relying Party Trust Identifier is different for each Sugar instance that you integrate. So you will not be able to use the default.

  2. 

    SugarCRM uses a very oold version of the Onelogin SAML toolkit.
    https://github.com/sugarcrm/sugarcrm_dev/tree/master/modules/Users/authentication/SAMLAuthenticate/lib/onelogin

    A review of this implementation is required.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s