---
title: "Identity Providers"
slug: "identity-providers-1"
updated: 2026-10-29T17:05:25Z
published: 2026-10-29T17:05:25Z
canonical: "wiki.cobblestonesoftware.com/identity-providers-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.cobblestonesoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity Providers

**COBBLESTONE SOFTWARE**

Contract Insight — User Guide

**Identity Providers**

*Single Sign-On › Single Sign On Overview › Identity Providers*

**Note:** Each procedure in this guide begins at the Contract Insight homepage, so any section can be followed on its own. Custom fields are configurable, so the exact field list on a contract category record may vary between environments.

# 1. Overview

CobbleStone® supports the SAML 2.0 and ADFS / WS-Federation protocols for Single Sign-On (SSO). Each identity provider (IdP) has its own setup instructions for SAML authentication (see Section 7 for links). On the Contract Insight side, IdP setup happens on **Administration → Single Sign-On**. There you publish the **Service Provider Metadata** to your IdP, upload the IdP's signing certificate under **Identity Provider Certificates**, enter the IdP details in an **SSO Configuration**, and then switch the **Login Method**. Internal users (**Your people** tab) and vendors/clients signing in through the Vendor/Client Gateway (**Vendors & clients (Gateway)** tab) are configured separately, each with its own identity provider, certificate and login method.

# 2. Key Elements

- **Your people / Vendors & clients (Gateway)** tabs: separate SSO setups for internal users and Gateway users. Changing one never affects the other.
- **Login Method**: for internal users, Standard (username / password), Integrated Windows Authentication, SAML 2.0 Single Sign-On, or ADFS / WS-Federation. Click **Apply** to switch, and **Refresh configuration** to reload settings from the database.
- **Service Provider Metadata**: **SAML metadata (XML)**, **WS-Fed metadata (XML)** and **SP signing certificate (.cer)**. Give these to your IdP so it trusts Contract Insight as a service provider.
- **Identity Provider Certificates**: upload the IdP's signing certificate with **Add certificate**, either as a file or from a metadata URL.
- **SSO Configurations**: the IdP connection settings (IDP Login URL, Audience Restriction, Entity ID, User Name Location, Assertion Consumer Service URL, Single Logout, Debugging), with row actions for **Edit**, **Just-in-time provisioning**, **Metadata** and **Delete**.
- **Debug log**: traces sign-in attempts when **Debugging** is turned on in a configuration.

# 3. Navigating to Single Sign-On

1. From the Contract Insight homepage, click the **Administration** icon at the bottom of the left navigation menu.
2. Under **Security & Access**, click **Single Sign-On**.

![Administration page with Single Sign-On highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-01-admin-sso.png)

# 4. Connecting an Identity Provider (Your People)

## 4a. Sharing the Service Provider Metadata

1. On the **Single Sign-On** page, make sure the **Your people** tab is selected.
2. Under **Service Provider Metadata (Give These to Your IdP)**, download the **SAML metadata (XML)** (or **WS-Fed metadata (XML)** for ADFS) and the **SP signing certificate (.cer)**.
3. Use these files to register Contract Insight as an application/relying party in your identity provider, following the IdP's own instructions (see Section 7).

![Single Sign-On Your people tab with Login Method and Service Provider Metadata](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-02-sso-your-people.png)

**Note:** Leave the **Login Method** on **Standard** until the certificate and configuration are complete and tested. Switching it first can lock users out.

## 4b. Uploading the IdP Certificate

1. Under **Identity Provider Certificates**, click **Add certificate**.
2. In the **Add Certificate** window, either:
  - **Option 1:** click **Choose File** and upload the **.cer** file or XML metadata file (containing the X509 certificate) exported from your IdP, or
  - **Option 2:** paste the IdP's federation metadata **URL** and click **Download**.
3. Confirm that the certificate is listed with its **Expires** date and shows as **Active**.

![Add Certificate window](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-04-add-certificate.png)

# 5. Configuring the SSO Configuration

1. Scroll to **SSO Configurations**. Click **Add configuration** to create one, or **Edit** on an existing row. The row icons also open **Just-in-time provisioning**, download this configuration's **Metadata**, or **Delete** it.

![SSO Configurations list with Add configuration and Edit](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-03-sso-configurations.png)

1. In **Edit Configuration**, complete the IdP details:
  - **Name** and **Active**: identify the configuration and turn it on.
  - **Single Sign On Mode**: **Single Sign On Only**, or **Single Sign On and Standard Logins**.
  - **Standard Login Address**: use **Copy** and keep this address somewhere administrators can find it. With **Single Sign On Only**, this address is closed and everyone is sent to the IdP.
  - **IDP Login URL**: the IdP URL users are redirected to when authentication is required.
  - **Audience Restriction** and **Entity ID**: usually the address the IdP redirects to. If Entity ID is blank, the ACS URL is used.

![Edit Configuration fields (top)](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-05-edit-config-top.png)

1. Continue with the remaining settings:
  - **User Name Location**: **NameId**, or **Attribute** with the exact (case-sensitive) attribute name from the assertion.
  - **SP Initiate Method**: **Post** or **Redirect**.
  - **Assertion Consumer Service URL**: the URL the IdP sends authentications to.
  - **Enable Single Logout** and **Single Logout URL**: optional; also signs the user out at the IdP.
  - **Debugging**: turn on while testing, then review attempts with **Debug log**.
2. Click **Save** (or **Cancel** to discard changes).

![Edit Configuration fields (bottom) with Save](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-06-edit-config-bottom.png)

1. Back at the top of the page, set **Login Method** to **SAML 2.0 Single Sign-On** (or **ADFS / WS-Federation**) and click **Apply**. If the application runs on more than one server, click **Refresh configuration** on each instance.

# 6. Configuring SSO for Vendors & Clients (Gateway)

1. Click the **Vendors & clients (Gateway)** tab.
2. Repeat Sections 4 and 5 using the Gateway's own metadata, certificate and configuration. This setup is separate from your own people's.
3. Choose the Gateway **Login Method**: **Standard** (user name, password and company ID), **Simplified** (email address and password), **SAML 2.0 Single Sign-On**, or **ADFS / WS-Federation**. Then click **Apply**.

![Vendors and clients Gateway tab](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/idp-07-sso-gateway.png)

# 7. Identity Provider Documentation

Below are links to the documentation from popular/common Identity Providers:

**Microsoft Azure AD:**

[https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance](https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance)

**Okta:**

[https://developer.okta.com/docs/concepts/saml/](https://developer.okta.com/docs/concepts/saml/)

**One Login:**

[https://www.onelogin.com/learn/saml](https://www.onelogin.com/learn/saml)

**Shibboleth:**

**[](https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview)**[](https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview)[https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview](https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview)

**Ping:**

[https://docs.pingidentity.com/](https://docs.pingidentity.com/)

# 8. Quick Reference Summary

| Task | How to Complete It |
| --- | --- |
| Open SSO settings | Administration → Security & Access → **Single Sign-On**. |
| Give metadata to the IdP | Service Provider Metadata → **SAML metadata (XML)** / **WS-Fed metadata (XML)** / **SP signing certificate (.cer)**. |
| Upload the IdP certificate | Identity Provider Certificates → **Add certificate** → Choose File, or URL → **Download**. |
| Enter IdP settings | SSO Configurations → **Add configuration** or **Edit** → complete fields → **Save**. |
| Turn on SSO | Login Method → SAML 2.0 Single Sign-On or ADFS / WS-Federation → **Apply**. |
| Set up Gateway SSO | **Vendors & clients (Gateway)** tab → repeat the same steps. |
| Troubleshoot sign-in | Turn on **Debugging** in the configuration → **Debug log**. |