How to configure Arcon SAML Single Sign-On
Configure SAML-based Single Sign-On (SSO) between Arcon and Fyno to enable secure user authentication using corporate credentials.
Overview
With this example, you’ll learn how to configure SAML-based Single Sign-On (SSO) between Arcon and Fyno. Once configured, users can securely access Fyno using their corporate credentials managed in Arcon, eliminating the need for separate usernames and passwords.
In this setup:
- Arcon acts as the Identity Provider (IdP).
- Fyno acts as the Service Provider (SP).
SAML SSO enables centralized authentication, improved security, and simplified user lifecycle management.
Prerequisites
Before starting, ensure you have:
- Admin access to the Arcon Admin Console.
- The Fyno SAML endpoints (ACS URL, Audience URL).
- The IdP signing certificate from Arcon (.pfx format with password).
Configure a SAML Application in Arcon
In this step, you create and configure a SAML application in Arcon that represents Fyno.
- Log in to the Arcon Admin Console.
- Navigate to Applications or SSO Configuration.
- Select Method of Single Sign-On as SAML.
- Choose Configure SAML (not Insert Metadata).
This opens the SAML configuration screen where Arcon will be set up to communicate with Fyno.
Configure SAML Endpoint Settings
These settings define where Arcon sends SAML assertions and how Fyno validates them.
SAML Configuration Fields
| Setting | Value | Description |
|---|---|---|
| Application URL / ACS URL | https://… saml/acs/fyno-esaf | Endpoint where ARCON sends SAML responses after authentication. |
| Recipient URL | https://… saml/acs/fyno-esaf | Intended recipient of the SAML assertion. |
| Destination URL | https://… saml/acs/fyno-esaf | Destination attribute in the SAML response. |
| Audience URL | https://… saml/metadata | Identifies Fyno as the Service Provider. |
You can obtain the ACS URL from the SAML/SSO configuration section in the Fyno platform.
IMPORTANT: All three URLs (ACS, Recipient, Destination) must match exactly to avoid SAML validation errors.
Upload the Arcon Signature Certificate
To establish trust between Arcon and Fyno:
- In Signature Certificate, upload the Arcon IdP certificate.
- Format:
.pfx. - Enter the Certificate Password.
- Confirm the certificate is successfully uploaded.
Fyno will use this certificate to verify that SAML assertions are signed by Arcon.
Configure Identity and Username Mapping
These settings determine how user identity is passed from Arcon to Fyno.
| Setting | Value |
|---|---|
| Name ID Format | |
| Application UserName | |
| Update Application UserName | Create & Modify |
This ensures users are identified by their email address.
Configure Security and Signing Options
These options control how SAML responses are protected.
| Setting | Value |
|---|---|
| Response | Unsigned |
| Assertion Signature | Signed |
| Signature Algorithm | RSA-SHA256 |
| Assertion Encryption | Encrypted (or UnEncrypted, based on Fyno configuration) |
| Bindings | POST |
| Enable Single Logout | Disabled |
Save and Activate the Configuration
- Save the SAML configuration in Arcon.
- Assign users or groups to the application (if applicable).
- Ensure the application is enabled.
Only assigned users will be able to authenticate into Fyno using SSO.
Verify the Integration
To validate the setup:
- Log out of Fyno.
- Log in to the Arcon access portal and locate the Fyno application assigned to you.
- Click the Fyno application in Arcon and authenticate using your corporate credentials (if prompted).
- Confirm you are redirected to the Fyno dashboard.
Notes
If a user is removed or access is revoked in Arcon, they will immediately lose access to Fyno.