Getting Started

The following sections contain information that is relevant to getting started with SAML on OneSpan Sign:

• Configuring One or More Accounts for Senders

• Optional Account Settings for Senders

• Configuring SSO for Recipients

Configuring One or More Accounts for Senders

This section is relevant only if you want to configure SSO for "senders" (members of a OneSpan Sign account).

One of the following topics applies to your situation:

• Configuring a Single Account

• Configuring Multiple Accounts

Configuring a Single Account

OneSpan Sign has a setting for single accounts, called Sender Auto Provisioning. Auto-provisioning is enabled for an account when the parameter allowSenderCreation in the file saml.config has a defined value of true. This feature is enabled by default.

If this feature is enabled, the first time a sender tries to log in via SSO, OneSpan Sign will create an account for them, and will give them access to OneSpan Sign's User Interface for senders.

If this feature is disabled, an organization must manually add a sender to a OneSpan Sign account before they can log in via SSO.

SSO and Roles and Permissions

If Sender Auto Provisioning has been disabled a sender will automatically be activated upon logging in for the first time (assuming that their activation status is Pending, and not Locked). If Roles and Permissions have been enabled, then this feature works in the following scenarios:

• Pending user with no role

• Pending user with role

• Active user with no role

• Active user with role

Configuring Multiple Accounts

Optionally, multiple OneSpan Sign accounts can be configured to use the same Identity Provider for SSO.

Optional Account Settings for Senders

This section is relevant only if you want to configure SSO for "senders" (members of a OneSpan Sign account).

The following optional SSO-related settings can be configured at the account level:

• Force SSO Login

• Custom Redirection URLs

• Sender Email Templates

Force SSO Login

To force the senders on an account to log in to OneSpan Sign via SSO, you must enable SSO login at the account level. To arrange this, please contact our Support Team.

This setting will block users from accessing OneSpan Sign via its Login page.

Custom Redirection URLs

In response to certain events, OneSpan Sign by default redirects users back to OneSpan Sign's main Login page.

This may be undesirable when using SSO, since a typical user will not have a username or password for that page (instead they use an SSO login URL).

The best practice is to override these redirection URLs. Thus you should provide URLs of your choice for the following:

Sender Email Templates

OneSpan Sign's SAML feature has email templates that can be used to send email notifications to senders under the following conditions:.

• Forgot your password

• Opt out

• Decline

• Account invitation

• Expire

• Bounced

• Complaint

• Out of the office

• Reassign sender

• Ready to complete

• Lock signer

• Login lockout

• KBA failure

The above email templates contain the variable $LINK_URL;, which redirects senders to OneSpan Sign's Login page. Instead, you will want to redirect senders to the SSO URL. To arrange this, please contact our Support Team. Note: Switching to the SSO URL prevents senders from using the Forgot Password link on OneSpan Sign's main page.

The Account invitation email will not be sent to senders if they are auto-provisioned upon SSO login (see Configuring a Single Account), or if they are provisioned via the REST API or SDK.

Configuring SSO for Recipients

This section is relevant only if you want to configure SSO for "recipients" (not members of a OneSpan Sign account).

For a given transaction, SSO authentication can be assigned to one or more "recipients" in either of the following ways:

• Configuring SSO via the New User Experience

• Configuring SSO via the SDK and REST API