---
title: "SSO Using SAML2 Integration With miniOrange"
slug: "sso-using-saml2-integration-with-miniorange"
updated: 2026-10-07T17:43:38Z
published: 2026-10-07T17:43:38Z
canonical: "docs.wasabi.com/sso-using-saml2-integration-with-miniorange"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wasabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Using SAML2 Integration With miniOrange

Wasabi offers Single Sign-On (SSO) for Wasabi accounts via miniOrange as the Identity Provider (IdP) using SAML2 (Security Assertion Markup Language).

This article provides configuration instructions for both the miniOrange administrator and the SSO user to properly set up and complete a Wasabi Console login using your organization’s SAML2 SSO service.

## Configuring the SAML App in miniOrange (IdP Side)

1. Log in to your **miniOrange Admin Console** account `https://login.xecurify.com/moas/login)`.
2. Navigate to **Apps**. The Applications page is displayed.
3. Click **+ Add Application** to create a new application.
4. On the Choose Application page, search for and select **Custom SAML App**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-EQWTHTCR.png)
5. On the **Basic** tab, configure the Wasabi Service Provider (SP).

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-VMD0AO0D.png)

Enter the following values in their respective fields.
  - Display Name—Wasabi SSO.
  - SP Entity ID or Issuer—A unique Identifier for the service provider `https://sso.wasabisys.com/saml`.
  - ACS URL—The Assertion Consumer Service URL is used when configuring SAML 2.0 Single Sign-On (SSO) `https://sso.wasabisys.com/login/callback`.
  - Audience URI—Identifies Wasabi as the intended service provider for the SAML authentication response `https://sso.wasabisys.com/saml`[.](https://sso.wasabisys.com/saml.)
  - Single Logout URL—Leave this field blank.
  - Upload App Logo—Optionally, upload an application logo for the Wasabi SSO application.
6. Verify that the values are entered correctly, click **Next**, then select the **Advanced** tab to configure.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot 2026-09-29 at 8.19.03 AM (1).png)

Enter the following values in their respective fields:
  - Signed Request—Leave this option unchecked.
  - Sign Response—Leave this option unchecked.
  - Sign Assertion—Enable this option.
  - Signature Algorithm—Select **RSA-SHA256** from the dropdown.
  - Encrypt Assertion—Leave this option unchecked.
  - Relay State—Leave the default setting.
  - Override Relay State—Leave this option unchecked.
  - Keep the remaining settings at their default values.
7. Click **Next**, then select the **Login Options** tab for configuration.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-XB2RY1UJ.png)

Enter the following values in their respective fields:
  - Primary Identity Provider—Select **MINIORANGE** from the dropdown.
  - Force Authentication—Leave this option unchecked.
  - Show On End User Dashboard—Enable this option to make the Wasabi SSO application available to assigned users.
8. Click **Next**, then select the **Attributes** tab for configuration.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-5LIY050A.png)

Enter the following values in their respective fields:
  - Name ID—Select **E-mail Address** from the dropdown.
  - Name ID Format—Select `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` from the dropdown.
  - Add Name Format—Leave this option unchecked.
  - Enable Multi-Valued Attributes—Leave this option unchecked.
  - In the Attribute Mapping section:
    - Attribute Name—Add **groups.**
    - Attribute Type—Select **User Groups** from the dropdown.
    - Attribute Name—Add **email**.
    - Attribute Type—Select **E-mail Address** from the dropdown.
9. Click **Save** to complete the SAML configuration.

### Create a Group in miniOrange

A group is a collection of users. Create a Group in miniOrange to map an application to a set of users.

1. Navigate to **Groups**, then select **Manage Groups**. The Groups page is displayed.
2. Click **Add Group** in the upper-right corner. The Add New Group modal is displayed.![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-IK9L1GJ8.png)
3. Enter a **Group name** to assign Wasabi access to users, for example, **wasabi-admin**. Note the group name for later use when configuring SSO in the Wasabi Console. You must use the same name for the Wasabi SSO role as in the miniOrange group.
4. Click **Save** to create the new group.

### Add Users to the Group

1. Navigate to the new **wasabi-admin** in Groups, click the **three dots**, and then select **Edit**. The wasabi-admin Group page is displayed. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-HPFSHMFN.png)
2. In the Assignment tab, click **Assign Users**, select the users who should have access to the Wasabi Console.
3. Save the assignment.

### Assign the Group to the Wasabi SSO Application

Assigning a group to the Wasabi application determines which miniOrange users can access the application. Mapping a group attribute determines whether group information is included in the SAML assertion sent to Wasabi.

1. Navigate to **Apps**, select the **Wasabi SSO** application, then click the **Policies** tab.
2. Click **Assign Group**.![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-QL9N758E.png) Enter or select the following values in the corresponding columns for the new group:
  - Group Name—Select the checkbox for the Group Name, for example, **wasabi-admin**.
  - First Factor—Set to **Password**.
  - 2FA—Leave this field disabled, unless required by your organization.
  - Adaptive—This field refers to authentication. Leave this field disabled, unless required by your organization.
3. Save the **Policy**.

### Configure IdP Metadata in Wasabi

Configure the Identity Provider (IdP) metadata in Wasabi to establish the SAML SSO connection and enable user authentication.

1. Navigate to **Apps**, select the **Wasabi SSO** application, and click the **Metadata** tab.
2. Choose one of the following three methods required to configure miniOrange IdP for Wasabi.

In this example, the IdP Metadata XML file was used.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-QW5JF6WH.png)
  - IdP Metadata XML—Download the Metadata XML file from miniOrange and upload it to Wasabi.
  - IdP Metadata URL—Copy the Metadata URL from miniOrange and enter it in Wasabi.
  - Manually enter details—Configure the following:
    - Sign In URL—miniOrange SAML Login URL.
    - Sign Out URL—miniOrange SAML Logout URL.
    - X509 Signing Certificate—miniOrange Download Certificate.

## Configuring SAML Settings in Wasabi Console (SP / Client Side)

Configure the SAML settings in Wasabi Control to establish Wasabi as the Service Provider (SP) and enable SSO authentication with your Identity Provider (IdP).

1. Sign in to the [Wasabi Console](https://console.wasabisys.com/login) `https://console.wasabisys.com/login` using a **Root account** email.
2. Select **Security** in the left menu, then select the **SSO (Single Sign On)** tab and click **Start SSO Configuration**. The SSO (Single Sign On) page is displayed.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-Q8DCH747.png)

Enter or select the following values in their respective fields:
  - Organization Name—Enter your organization’s unique name, then click **Add Organization**.
  - SSO Connection—Select SAML from the dropdown.
  - IDP Metadata XML—Select this option in the SAML Connection section.
  - Metadata File—Select **+ Choose File**, then upload the **miniOrange Metadata XML** file downloaded earlier.
  - Sign In URL—Verify this field was populated from the miniOrange metadata.
  - Sign Out URL—Verify this field was populated from the miniOrange metadata.
  - Sign SAML Request—Keep this field enabled.
3. Click **Save** to save the SSO configuration.
4. In the SSO Single Sign-On tab, select **Settings**, then click **Create Role.** The role name should match the miniOrange group name configured earlier. For example, wasabi-admin.

> Do not create the role through the Role tab on the left. SSO roles must be created using the SSO tab in the Settings section.
5. In the **Assign Role Policies** panel, select the appropriate policy for the newly created role, then click **Create Role**. The new role is displayed in the Roles panel.![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-4D5DMS09.png)

## Testing the Integration

Test the SAML SSO integration to verify that users can successfully authenticate through the Identity Provider (IdP) and access Wasabi Control.

1. Sign in to the [Wasabi Console](https://console.wasabisys.com) `https://console.wasabisys.com` to test the SSO configuration.
2. Click **Sign In With SSO**. The SSO Sign In panel is displayed.![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-XQBG1IJ9.png)
3. In the SSO Sign In panel, select **Sign In With an Organization Name**, and enter your organization’s name configured earlier. You are redirected to miniOrange for authentication.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-A3RAAMEZ.png)
4. In miniOrange, sign in as an authorized miniOrange user assigned to the appropriate group.
5. After successful authentication, you are redirected back to the Wasabi Console.
6. Verify that the user is successfully logged in and has the permissions associated with the corresponding Wasabi SSO role.

To configure IdP-initiated login, refer to [IdP-Initiated SAML Login for miniOrange SSO](https://docs.wasabi.com/docs/idp-initiated-saml-login-for-miniorange-sso).