This feature is available only on the Enterprise plan.
To find provider-specific tutorials, please refer to the corresponding section.
In this article you'll learn how to set up single sign-on with Lokalise.
Getting started
To get started, log into Lokalise, click on the avatar in the bottom left corner and choose Team settings:
Accessing Team settings
Accessing Team settings
Then, proceed to the Advanced security tab and tick the Enable SSO field.
Parameters
Use these parameters to configure your custom SAML connection.
SSO flows
Lokalise supports Identity Provider (IDP) Initiated Flow and Service Provider (SP) Initiated flow.
For SP-Initiated single sign-on, go to
https://app.lokalise.com/sso/yourdomain.com
Assertion Consumer Service URL
https://app.lokalise.com/sso/yourdomain.com/acs(Also known as the SSO post-back up URL)
Entity ID
https://lokalise.com
Please keep in mind that Lokalise does not support Single Logout or session duration configured in your IDP.
Considerations
Lokalise supports HTTP POST binding, not HTTP REDIRECT. You must configure HTTP POST bindings in the IDP metadata.
Your IDP must ensure a user is both authenticated and authorized before sending an assertion. If a user isn't authorized, assertions should not be sent. We recommend your identity provider redirects people to a HTTP 403 page or something similar.
To prevent misconfiguration and authentication errors please keep in mind the following:
Fill out values exactly as provided by Lokalise and your Identity Provider (IdP).
SAML attribute names and values are case-sensitive.
At least NameID and Email attributes must be added to your SAML app configuration.
Extra slashes, whitespaces, wrong character case, etc. may lead to errors.
Settings to include
NameID (Required)
To meet SAML specifications, the NameID must be unique, pseudo-random, and should not change for the user over time — like an employee ID number.
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">Your Unique Identifier</saml:NameID>
</saml:Subject>
Email Attribute (Required)
<saml:Attribute Name="User.Email"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">testuser@youremail.com
</saml:AttributeValue>
</saml:Attribute>
First Name Attribute (Optional)
<saml:Attribute Name="first_name"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">FirstName
</saml:AttributeValue>
</saml:Attribute>
Last Name Attribute (Optional)
<saml:Attribute Name="last_name"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">LastName
</saml:AttributeValue>
</saml:Attribute>
SP metadata URL (Optional)
https://app.lokalise.com/sso/yourdomain.com/metadata
Returns Lokalise's SAML Service Provider (SP) metadata in XML format, including the entity ID, Assertion Consumer Service (ACS) URL, and other SP settings.
If your identity provider (IdP) supports importing SP metadata, you can use this URL instead of entering the SAML configuration values manually.
To access the metadata, you must be signed in to Lokalise as a team admin of the team that owns the SSO domain. SSO must also be enabled for that team. Replace yourdomain.com with the SSO domain configured under Team settings → Advanced security.
Certificates
Public certificate
Lokalise requires signed SAML responses. To verify their signatures, you must provide a valid X.509 certificate in .pem format from your identity provider (IdP). This certificate is different from the SSL/TLS certificate used to secure your website.
Signing certificate
If your identity provider requires signed authentication requests (AuthnRequest), enable the Sign AuthnRequest option in your team's SSO settings.
When enabled, Lokalise signs authentication requests sent to your IdP. You can retrieve the corresponding certificate from your team's SSO settings and configure it in your IdP.