Lucid offers SAML integrations to Enterprise accounts so that admins can easily manage the users on their Lucid teams using their IDPs.

Lucid’s SAML integration allows you to connect Lucid to your IDP so that users on your account can quickly and securely authenticate through your IDP using SAML SSO. You can also configure your team's settings so that users are automatically created in Lucid when they sign in for the first time after they are assigned the Lucid app in your IDP.

The purpose of this article is to walk you through setting up a SAML connection within Lucid. We will cover the general info and link to resources that cover specific IDP's before covering advanced setups.

This feature is only available to Enterprise accounts. See the Upgrade your Lucid account article for instructions to upgrade.

Download Lucid service provider metadata

In Lucid, click Admin.
Select App integration from the left-hand menu.
Select the SAML tile.
Enter what you intended to use as your IDP entity ID in the domain text box. The SAML integration will use your domain to generate a Lucid sign-in URL that you will supply to your IDP. A user may go directly to this URL to initiate SAML SSO.
- Make sure to just enter the domain, not the full URL. For example, if you were to enter 'acme.com' as your domain, the URL will be https://lucid.app/saml/sso/<your domain here>.
Download the metadata in the bottom right-hand corner. (If your application uses OID naming conventions please click the OID checkbox before generating the metadata)

Set up a Lucid SAML 2.0 connection in your IDP:

The basic information needed to set up a SAML connection in your IDP:

SP identifier/entityID/audience restriction:	lucidchart.com
Sign on URL:	https://lucid.app/saml/sso/<yourdomain>
ACS/Reply URL primary Index = 0:	https://lucid.app/saml/sso/<yourdomain>
ACS/Reply URL secondary Index =1: (this is only needed for accounts that use federated SAML metadata)	https://www.lucidchart.com/saml/sso/<yourdomain>
SSO Service Binding:	We default to POST, but can work with REDIRECT (please contact us if you are using REDIRECT)
Digest Algorithm:	SHA-256
nameID:	We prefer working with email, but can work with other values

If you are in the FedRAMP environment, refer to our FedRAMP overview article for the values needed to set up a Lucid SAML 2.0 connection in your IDP.

Attribute statement:

Value Name	Accepted naming convention	OID naming convention
email	user.email	urn:oid:0.9.2342.19200300.100.1.3
first name	user.firstname	urn:oid:2.5.4.42
last name	user.lastname	urn:oid:2.5.4.4

Add IDP metadata to Lucid and testing your SAML connection:

Upload your metadata to Lucid at the SAML configuration in the Lucid admin panel (we only accept XML files, so you may need to convert your text to an XML file)
Once the metadata is uploaded you can use the Test SAML Connection button below the populated metadata to run a simulated SP sign-on.

SAML standards and pre-built IDP apps

We support the SAML 2.0 standard and the following pre-built IDP apps: Azure, Okta, and OneLogin.

Tip: To see the most common errors and their recommended solutions, check out this post in the Lucid Community. You can also post a question to get support.

Resources

To learn more about this feature, explore the additional resources below. These resources are available in English only.

Community post

Tips for switching between SAML providers

Related articles