Lucid Help Center   ›   Account   ›   Account management   ›   SAML overview

SAML overview

Written by:  Shanna S
Last updated:  

Lucid offers SAML integrations to Enterprise accounts so that admins can easily manage users' access to Lucid via identity prodivers (IdPs).

Lucid’s SAML integration allows you to connect Lucid to your IDP so that users on your account can quickly and securely authenticate through your IDP using SAML SSO. You can also configure your account's settings so that users are automatically created in Lucid when they sign in for the first time after they are assigned the Lucid app in your IDP.

The purpose of this article is to walk you through setting up a SAML connection within Lucid. We will cover the general info and link to resources that cover specific IDP's before covering advanced setups.

Plan availability: Enterprise only.

Download Lucid service provider metadata

  1. In Lucid, click Admin from the More menu in the bottom-left corner.
  2. Select App integration from the left-hand menu.
  3. Select the SAML tile.
  4. Enter what you intended to use as your SAML domain in the domain text box. 
    • The SAML integration will use your domain to generate a Lucid sign-on URL that you will supply to your IDP. A user may go directly to this URL to initiate SAML SSO.
    • Make sure to just enter the domain, not the full URL. For example, if you were to enter 'acme.com' as your domain, the URL will be https://lucid.app/saml/sso/<your domain here>. 
  5. If your application uses OID naming conventions, click the OID checkbox. Otherwise, skip this step.
  6. Download the metadata in the bottom right-hand corner. 

Set up a Lucid SAML 2.0 connection in your IDP

SAML standards and pre-built IDP apps 

We support the SAML 2.0 standard and the following pre-built IDP apps: Microsoft Entra ID and Okta.

The basic information needed to set up a SAML connection in your IDP: 

SP identifier/entityID/audience restriction: lucidchart.com
Sign on URL: https://lucid.app/saml/sso/<yourdomain>
ACS/Reply URL primary Index = 0: https://lucid.app/saml/sso/<yourdomain>
ACS/Reply URL secondary Index =1: (this is only needed for accounts that use federated SAML metadata) https://www.lucidchart.com/saml/sso/<yourdomain> 
SSO Service Binding: We default to POST, but can work with REDIRECT (please contact us if you are using REDIRECT)
Digest Algorithm: SHA-256
nameID: We prefer working with email, but can work with other values 

If you are in the FedRAMP environment, refer to our FedRAMP overview article for the values needed to set up a Lucid SAML 2.0 connection in your IDP. 

 Attribute statement:

Value Name Accepted naming convention  OID naming convention 
email user.email   urn:oid:0.9.2342.19200300.100.1.3 
first name user.firstname  urn:oid:2.5.4.42 
last name user.lastname urn:oid:2.5.4.4 

 

Add IDP metadata to Lucid and test your SAML connection

  1. Log into Lucid.
  2. Navigate to the Lucid admin panel.
  3. Open your IdP in another tab.
  4. Generate a certificate in your IdP.
  5. Once generated, download the IdP metadata.
  6. Return to your Lucid admin panel tab.
  7. Select App integration from the left-hand menu.
  8. Select the SAML tile.
  9. In the identity provider section, upload the new IdP metadata to Lucid.
    • Lucid only accepts XML files, so you may need to convert your text to an XML file.
  10. If required by your IdP, return to your identity provider tab and activate the certificate.
  11. Once the metadata is uploaded, click Test SAML Connection below the populated metadata to run a simulated SP sign-on.

Update your IdP certificate

  1. Log into Lucid.
  2. Navigate to the Lucid admin panel.
  3. Select App integration from the left-hand menu.
  4. Select the SAML tile.
  5. Optionally, save your current XML metadata locally.
    • In the identity provider section, click Edit for the current metadata. Copy and paste this into a document on your local device.
    • This is a safety precaution in case anything goes wrong while replacing the certificate.
  6. Click Remove on your current metadata to remove it from our SAML portal.
  7. Open your IdP in another tab.
  8. Generate a new certificate in your IdP.
  9. Once generated, download the IdP metadata.
  10. Return to your Lucid admin panel tab.
  11. In the identity provider section, upload the new IdP metadata to Lucid.
    • Lucid only accepts XML files, so you may need to convert your text to an XML file.
  12. If required by your IdP, return to your identity provider tab and activate the certificate.
  13. Once the new metadata is uploaded, click Test SAML Connection below the populated metadata to run a simulated SP sign-on.

Locate certificate needed to encrypt assertions

Encrypted assertions require a custom SAML IDP.

To download the encryption certificate in Lucid and upload it into your IDP, follow these steps:

  1. Navigate to the Lucid admin panel.
  2. Select App integration from the left-hand menu.
  3. Under the “General” tab, locate the “SAML” tile and click Settings.
  4. On the Activation page, scroll down to the “Download encryption certificate” section.
  5. Select Download certificate.
  6. Follow your specific identity provider’s instructions to enable encrypted assertions with the certificate you downloaded from Lucid.

Toggle IDP assertion encryption

After activating an IDP for SAML connection in Lucid, you will see an Assertion encryption listing where it states whether the assertions for the identity provider are “Encrypted” or “Unencrypted”. Assertion encryption secures user identity data by encrypting statements shared between the identity provider and service provider, ensuring privacy and integrity.

To change an IDP between unencrypted and encrypted assertions, follow these steps:

  1. Click Edit at the bottom of an IDP Lucid admin panel.
  2. Toggle Assertion encryption in the pop up window.
  3. Select Save.

Note: IDP assertions are unencrypted by default.

Resources

To learn more about this feature or to ask additional questions, explore the additional resources below. These resources are available in English only.

Community posts

Give feedback on this article

Have feedback about this article? Tell us about your experience here. 

Did you find what you were looking for?

Still have a question or want to share what you have learned? Visit our Community   to get help and collaborate with others.