Configuring Cleo Integration Cloud to use SAML

CIC supports SAML, allowing you to use your preferred authentication systems. It can integrate with identity providers (IDP) like OneLogin, Auth0, or Azure Active Directory, where the IDP handles the credentials. This means you don't have to manage IDs separately within CIC.

• An administrator enables SAML for a specific CIC tenant.
• One or more email domains are associated with that tenant.
• Any user whose email address belongs to a SAML‑enabled domain is automatically redirected to the identity provider when signing in.

• Users from SAML‑enabled domains always authenticate using SSO.
• Users from other domains continue to use standard CIC login methods.
• A single SAML configuration can apply consistently across multiple tenants, depending on domain association.

Note: Cleo Support must enable SAML for your tenant before you can access the SAML page.

Before Configuring CIC

Before you configure CIC to use SAML, make sure the following configuration is done on your system.

1. Ensure the SAML identity provider's SAML responses to Cognito contain an audience restriction as follows:

   <saml:AudienceRestriction>
   <saml:Audience> urn:amazon:cognito:sp:us-west-2_lQQzMSzLQ
   </saml:AudienceRestriction>

2. Ensure all SAML responses contain an InResponseTo element in the Response object that matches the request ID in the authentication request as in the following example:

   <samlp:Response ... InResponseTo="originalSAMLrequestId">

3. Ensure that a SubjectConfirmationData attribute has Recipient and InResponseTo values set as follows:

   <saml:SubjectConfirmation>
   <saml:SubjectConfirmationData ... Recipient="https://yourUserPoolDomain/saml2/idpresponse" InResponseTo="originalSAMLrequestd">
   </saml:SubjectConfirmation>

Configuring CIC to use SAML

Use the Admin > SAML page to configure Cleo Integration Cloud to use SAML for single sign-on.

Use these fields to customize your application. Changes you make are previewed as you make them.

Service Provider

Cleo provides you with the information in this section of the page to configure your IDP. You provide this information to your IDP to enable the IDP to trust Cleo Integration Cloud.

Note: Your IDP might use different names for the data provided in the fields below. Check with your IDP for more information.

Identity Provider

You provide access to a metadata file containing information about the Identity Provider (IDP).

Attribute Mappings

Attribute mappings allow Cleo Integration Cloud to identify various parts of a SAML assertion.

Verifying your IDP

After making the changes in your IDP provider (for example Okta, Azure AD, Onelogin), verify that your SAML integration still works and has the required fields.

1. Open a browser and pull down the ... menu. 

   

2. Go to More Tools and open Developer Tools. It might take a few seconds to open the Developer Tools in the browser.

   

3. Go to the Network tab and make sure the Doc button is selected.

   

4. With the Network tab open, go www.cleointegration.cloud, enter your email, and click Next. This should route you to your IDP Login.
5. Enter your IDP login information.

6. Once it redirects to the CIC, notice the Network tab now contains data from your network traffic. Find idpresponse in the Name column.

   

7. Click on idpresponse, go to the Payload tab and copy the payload value.

   

8. In a new browser tab and go to samltool.com/base64.php.

9. In the Decode section, paste the payload and click the BASE64 DECODE XML button.

   

10. The decoded payload is displayed.  Review the decoded payload to verify it contains the three items mentioned in the initial email (saml audience, InResponseTo, and the SubjectConfirmationData attributes).