Pushwoosh supports Single Sign-On over SAML 2.0. OIDC is not supported. Users are identified by email, so your identity provider (Keycloak, Okta, Azure AD, etc.) must send the email address as the NameID.
What to send to Pushwoosh Support
Preferably, a link to your IdP's SAML metadata. For Keycloak it looks like:
https://<your-keycloak>/realms/<your-realm>/protocol/saml/descriptor
If you can't share a metadata link, send these values instead:
- the IdP signing certificate (x509, RS256);
- the IdP Entity ID;
- the IdP Single Sign-On Service URL.
What you will configure on your side
Create a SAML client in your identity provider with these settings:
- Client ID / Entity ID:
https://sso.pushwoosh.com - Assertion Consumer Service (POST binding) URL: provided by Pushwoosh Support for your account.
- NameID format:
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress - Request signing is not required by default.
Related articles
- How do I set up Single Sign-On (SSO)? — plan requirements and how to request SSO.
Comments
0 comments
Please sign in to leave a comment.