Sign in to PaperTotal through your own identity provider.
Single sign-on is on the Business plan. It works with any provider that speaks SAML 2.0 or OpenID Connect, through Firebase Identity Platform, which signs people in for PaperTotal.
Setting it up
- Verify your domain under Settings, Domains, by adding the TXT record PaperTotal gives you. Single sign-on only ever vouches for addresses on a domain you have proven.
- Under Settings, Security, enter your provider, or upload its metadata. PaperTotal reads the entity ID, the HTTP POST sign-in address and the signing certificate from it, and refuses an expired certificate.
- Choose Test sign-in. Requiring single sign-on is refused until someone has come through the provider, so a mistake cannot lock everyone out.
- Turn on Require single sign-on. From then on, password, Google and Apple sign-ins are refused for everyone in the workspace, admins included, unless you keep the owner exempt. PaperTotal checks how each request signed in, not only the sign-in page, and asks again after a day.
What your provider needs
- Entity ID (audience)
- https://papertotal.com/yourcompany.com, shown under Settings, Security
- Assertion consumer service (reply) URL
- shown under Settings, Security, and in the metadata file you can download there
- Binding
- HTTP POST
- NameID format
- emailAddress, exactly the address the person signs in to PaperTotal with
- Assertions
- signed, with the whole X.509 signing certificate, BEGIN and END lines included
Provider by provider
Okta
- In the Okta admin console, go to Applications, Create App Integration, and choose SAML 2.0.
- Paste the reply URL as the Single sign-on URL and the entity ID as the Audience URI. Set Name ID format to EmailAddress and Application username to Email.
- Assign the people or groups who use PaperTotal, then download the Identity Provider metadata and upload it in PaperTotal.
Microsoft Entra ID
- In Entra, go to Enterprise applications, New application, Create your own application, and choose a non-gallery app.
- Under Single sign-on, choose SAML. Enter the entity ID as the Identifier and the reply URL as the Reply URL.
- Under Attributes and Claims, set the Unique User Identifier to user.mail with the email address format. Download Federation Metadata XML and upload it in PaperTotal. To use OpenID Connect instead, register an app and give PaperTotal its client ID, secret and issuer.
Google Workspace
- In the Google Admin console, go to Apps, Web and mobile apps, Add app, Add custom SAML app.
- Download the IdP metadata from the Google Identity Provider details page.
- Enter the reply URL as the ACS URL and the entity ID as the Entity ID, choose EMAIL as the Name ID format and Basic Information, Primary email as the Name ID. Turn the app on for your people.
OneLogin
- In OneLogin, go to Applications, Add App, and choose SAML Custom Connector (Advanced).
- Under Configuration, enter the entity ID as the Audience and the reply URL as the ACS URL and ACS URL Validator. Set SAML signature element to Assertion.
- Under Parameters, set NameID value to Email. Download the metadata from More Actions and upload it in PaperTotal.
AWS IAM Identity Center (AWS SSO)
- In IAM Identity Center, go to Applications, Add application, and choose a custom SAML 2.0 application.
- Download the IAM Identity Center SAML metadata file. Enter the reply URL as the Application ACS URL and the entity ID as the Application SAML audience.
- Under Attribute mappings, map Subject to ${user:email} with the emailAddress format, then assign users.
Oracle Identity Cloud Service
- In your identity domain, go to Integrated applications, Add application, and choose SAML application.
- Enter the entity ID and the reply URL as the Assertion consumer URL. Set Name ID format to Email address and Name ID value to Primary email.
- Activate the application, assign users, and download the identity provider metadata to upload in PaperTotal.
SAASPASS
- In the SAASPASS admin portal, add a custom SAML application.
- Enter the entity ID and reply URL, and send the user's email as the NameID in the emailAddress format.
- Download the SAASPASS metadata for the application and upload it in PaperTotal.
Microsoft ADFS
- In AD FS Management, add a Relying Party Trust that is claims aware, and import or enter the PaperTotal service provider metadata from Settings, Security.
- Add a claim issuance rule that sends LDAP Attribute E-Mail-Addresses as Name ID with the Email format.
- Export the token-signing certificate as Base-64 X.509, and give PaperTotal your federation metadata URL file or the entity ID, sign-in URL and that certificate.
These steps follow each provider's own screens, which change from time to time. If one no longer matches, write to support@papertotal.com.
Adding and removing people
Under Settings, Security, make a SCIM token. Give your provider the base URL https://api.papertotal.com/scim/v2 and the token as a bearer token. It adds people as invitations, changes their names, and takes them out when they are deactivated or deleted, for addresses on your verified domains only. Taking someone out works even if your plan has lapsed.
With Okta Workflows, add a flow that starts on User Created or User Assigned to Application, and add an HTTP Raw Request card that posts to https://api.papertotal.com/v1/members/provision with an API key that has the members:write scope. Send { "employees": [{ "employeeEmail": "...", "managerEmail": "...", "employeeID": "..." }] }, with isTerminated set to true to take someone out. Send dryRun first to see what would change. The API reference lists every field.
If your provider locks you out
Write to support@papertotal.com from an address on one of your verified domains. Support checks that the address is on one of them, then either stops requiring single sign-on for your workspace until you turn it back on, or lets one person past it for a day. Both are recorded in your audit log.
Keeping the owner exempt when you require single sign-on leaves one way in that does not depend on your provider.