Configure SAML for plan-level single sign-on to Smartsheet

As of February 5, 2024, you can't create new plan-level SAML configurations. You can still update, delete, or read existing configurations. To set up SAML for a new configuration, use domain-level SAML.

What's plan-level SAML?

Plan-level SAML allows users within your plan to sign in to Smartsheet using their organization's identity provider (IdP) credentials.

For a SAML setup that applies to all Smartsheet users within your domain, see Configure SAML for domain-level single sign-on to Smartsheet.

Before you begin

A System Admin and an IT Administrator are both required to set up SAML SSO with Smartsheet. Keep the following in mind before you configure plan-level SAML:

• Smartsheet supports Service-Provider-initiated SSO. If you're configuring IdP-initiated SSO, work with your IdP.
• You can use more than one SSO IdP at the same time.
• If the System Admin of an Enterprise plan validates your domain and sets up domain-level SAML, the domain-level configuration overrides any plan-level SAML configurations for users within that domain.

Use the metadata URL for your region to configure a relying party within your IdP. The process varies by IdP. Consult your IdP's documentation.

• US: www.smartsheet.com/sites/default/files/smartsheet-saml2-sp-metadata.xml
• EU: www.smartsheet.com/sites/default/files/smartsheet-saml2-sp-metadata-eu.xml
• AU: www.smartsheet.com/smartsheet-saml2-sp-metadata-au.xml

The SHA1 certificate algorithm is deprecated due to security vulnerabilities. Don't use an SSL certificate signed with SHA1.

SAML exchange process

Smartsheet requires the following attributes in the SAML exchange process:

• Persistent ID: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent 
• Email address: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

The following attributes are recommended but optional:

• Given Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname 

  This represents the user's first name.

• Surname: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname 

  This represents the user's last name.

Some SAML services may ask for additional information when you configure them with Smartsheet:

• Assertion Consumer Service (ACS) URL: https://sso.smartsheet.com/Shibboleth.sso/SAML2/POST 
  • On EU plans, use https://sso.smartsheet.eu/Shibboleth.sso/SAML2/POST
  • On AU plans, use https://sso.smartsheet.au/Shibboleth.sso/SAML2/POST
• Audience Restriction: https://sso.smartsheet.com/saml
  • On EU plans, use https://sso.smartsheet.eu/saml
  • On AU plans, use https://sso.smartsheet.au/saml

Keep the following in mind for the exchange process:

• Enter email addresses in lowercase. Capital letters can prevent matching of emails between your SAML provider and Smartsheet.
• The first assertion must have a Persistent ID that’s the same for each person whenever they sign in. Your email address can be a Persistent ID, but the Email address claim still needs to be passed in the assertion process. Email claims must be all lower case. For a sample assertion and a complete list of Smartsheet’s supported claim formats, see the SAML Assertion: Supported Claims Examples in Smartsheet article.
• The Persistent ID can be defined in the NameID (subject) element of the assertion.
• If the assertion doesn't have a NameID (subject) element, you can use one of the attributes defined in the Supported Claims article.
• Ensure you remove the attribute claim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/Name from the prepopulated attributes in Azure.

Configure plan-level SAML

To set up SAML SSO for Smartsheet Gov, you must meet additional requirements and apply specific settings before continuing. 

Open the SAML Administration form

1. In Admin Center homepage, scroll down to the Settings section and locate the Authentication card.

   Brandfolder Image

   

2. Select SAML.

   The Authentication form displays.

3. Select not configured. After doing these steps, the SAML Administration form displays.

   Brandfolder Image

   

• If this is your first time setting up the SAML in Smartsheet, the not configured button takes you to the domain-level SAML configuration page. If you still need to define plan-level SAML configuration, contact Smartsheet Support.
• If you already have a plan-level SAML configuration in place, you see the edit configuration button instead. Select it to modify your existing configuration.

Configure SSO with your IdP

Follow these steps to configure SAML with one or more IdPs:

1. Select Add IdP.

   Brandfolder Image

   

2. Enter a nickname for your IdP.

   Consult your IdP's documentation to determine how to obtain the IdP metadata.

3. Obtain the IdP metadata and copy it.

4. In the IdP Metadata textbox, paste the IdP metadata.

   Brandfolder Image

   
5. Copy the SSO URL and paste it in your IdP.
6. Select Save. After saving the changes you made, Smartsheet validates the metadata.
   • If the validation is successful, the Edit IdP ​form displays.
   • If you receive an error, check out the SAML FAQs help article.
   • You can add a CNAME that’ll direct people to a friendly URL when they sign in. See the Direct people to sign in at a friendly CNAME URL section below for more information.

7. Select Activate to enable the IdP for use with Smartsheet. The IdP status changes from Inactive to Active, Default. 

   Brandfolder Image

   

8. To enable SAML for your plan, in the Authentication form, select SAML.

   There must be at least one active IdP before enabling SAML.

9. Select Save.

   People in your plan can now sign in to Smartsheet using their organization's credentials.

Configure additional IdPs

While most organizations only need a single active IdP, there's no limit to the number you can add. To add or edit IdPs, select edit configuration next to the SAML checkbox. The SAML Administration form displays.

If you have more than one active IdP, users signing in via SAML authenticate against the default IdP. To make an IdP the default, in the Edit IdP form, select Make Default.

Brandfolder Image

Direct people to sign in at a friendly CNAME URL

Smartsheet provides a default SSO URL for your organization. You can create a CNAME record to give users a more company-specific sign-in URL.

Don't enter sso.smartsheet.com in the CNAME field of the Edit IdP form, as it can cause sign-in issues. Use a CNAME created by your organization and point it to sso.smartsheet.com.

1. In your domain, create a CNAME DNS record and point it at sso.smartsheet.com. For example, smartsheet.example.org IN CNAME sso.smartsheet.com.
2. In the Edit IdP ​form, enter the CNAME. 

3. Select Add​.

   Brandfolder Image

   

Reminders

• CNAME authentication can take up to one hour.
• HTTPS isn't supported for CNAME URLs. Only HTTP is supported.
• Removing a user's SSO access doesn't prevent them from accessing Smartsheet. To fully block access, delete that user from your organization’s Smartsheet plan.

SAML configuration states

SAML is always in one of the following states.

When SAML is enabled, each IdP is in one of the following states.