​
Overview

LowerPlane supports SAML 2.0 for any identity provider not covered by the built-in integrations. This includes:
  • OneLogin
  • JumpCloud
  • PingOne / PingFederate
  • Auth0
  • Keycloak
  • ADFS (Active Directory Federation Services)
  • Any other SAML 2.0 compliant IdP

​
Prerequisites

  • Admin access to your identity provider
  • Ability to create SAML 2.0 applications
  • Admin access to LowerPlane Settings

​
LowerPlane SAML Configuration

Provide these values to your identity provider when creating the SAML application:
SettingValue
Assertion Consumer Service (ACS) URLhttps://api.lowerplane.com/api/v1/auth/sso/callback/saml
SP Entity ID / Audiencehttps://app.lowerplane.com
Name ID Formaturn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
BindingHTTP-POST

​
Setup Steps

1

Create a SAML application in your IdP

In your identity provider’s admin console, create a new SAML 2.0 application:
  • Set the ACS URL to https://api.lowerplane.com/api/v1/auth/sso/callback/saml
  • Set the Entity ID / Audience to https://app.lowerplane.com
  • Set Name ID to the user’s email address
2

Configure attribute mapping

Map the following SAML attributes:
Attribute NameValueRequired
emailUser’s email addressYes
firstName or givenNameUser’s first nameRecommended
lastName or surnameUser’s last nameRecommended
The email attribute (or Name ID set to email format) is required. LowerPlane uses the email address to match SSO logins to existing user accounts.
3

Export IdP metadata

From your identity provider, obtain:
  • IdP SSO URL (Single Sign-On Service URL)
  • IdP Entity ID (Issuer)
  • X.509 Signing Certificate
Some providers offer a metadata XML file that contains all three values.
4

Enter IdP details in LowerPlane

In LowerPlane, go to Settings > SSO and select Custom SAML:
  • Paste the IdP SSO URL
  • Paste the IdP Entity ID
  • Paste the X.509 Certificate (include the BEGIN/END lines)
5

Test and enable

Click Test Connection to verify. Once successful, toggle SSO to Active.

​
Provider-Specific Guides

  1. Go to Applications > Add App and search for “SAML Custom Connector (Advanced)”.
  2. Set ACS URL and Audience as listed above.
  3. Under Parameters, add email, firstName, lastName.
  4. Copy the Issuer URL, SAML 2.0 Endpoint, and X.509 Certificate from the SSO tab.
  1. Go to SSO Applications > Add New Application > Custom SAML App.
  2. Enter the ACS URL in ACS URL and Entity ID in SP Entity ID.
  3. Set SAMLSubject NameID to email.
  4. Add attribute mappings for email, firstName, lastName.
  5. Download the IdP certificate and copy the SSO URL from the application details.
  1. Go to Connections > Applications > Add Application.
  2. Select SAML and configure with the ACS URL and Entity ID.
  3. Map attributes: email, given_name, family_name.
  4. Export the metadata or copy the IdP SSO URL and certificate.
  1. Open AD FS Management > Relying Party Trusts > Add Relying Party Trust.
  2. Select Enter data about the relying party manually.
  3. Set the Relying party trust identifier to https://app.lowerplane.com.
  4. Add a SAML POST endpoint with the ACS URL.
  5. Configure claim rules to send Name ID as email, plus firstName and lastName claims.
  6. Export the ADFS signing certificate and copy the Federation Service Identifier.

​
Troubleshooting

  • Verify the X.509 certificate hasn’t expired
  • Ensure the Name ID format is set to email
  • Check clock synchronization (SAML allows 5 minutes of clock skew)
  • Confirm the ACS URL and Entity ID match exactly (no trailing slashes)
Ensure the SAML response includes the user’s email address either as the Name ID or as an attribute named email. LowerPlane uses the email to match SSO logins to existing user accounts.
The certificate must be in PEM format, including the header and footer lines:
-----BEGIN CERTIFICATE-----
MIIDpDCCAoygAwIBAgI...
-----END CERTIFICATE-----
If your IdP provides a .cer or .crt file, open it in a text editor and copy the full content.