Skip to main content

SAML SSO Guide

Alwin Thomas
Updated

SAML SSO is a feature of Raisely Pro.

If your organisation uses an Identity Provider (IdP) for user authentication, you can configure Raisely to allow your users to log in using their IdP credentials.

Raisely offers single sign-on using the SAML SSO standard. SAML provides authentication and authorisation services by passing information between an IdP and a Service Provider. Raisely acts as a Service Provider in this instance.

SAML SSO can be used for login to the Raisely admin panel, as well as sign-up and login to Raisely campaign websites. Once the SAML SSO connection is configured, Raisely will automatically create and update users that log in via your IdP.

Configure SAML SSO

You must have an Identity Provider (IdP) to offer SAML SSO to your users.

Raisely uses two separate Service Providers for SAML SSO, depending on what your users are signing into:

Signing in to… Service Provider
The Raisely admin panel Raisely’s Admin sign-in service
A campaign website, such as donor sign-up or login Raisely’s campaign SAML service

If you only use SAML SSO for the Raisely admin panel, you only need to register the Admin service provider.

If you also use SAML SSO for campaign websites, you’ll need to register the Campaign service provider too. Depending on your Identity Provider, this may mean either:

  • adding a second ACS URL / Reply URL and Audience / Entity ID to your existing SAML application, or
  • creating a separate SAML application for the Campaign service provider.

Since these values are unique to your organisation, copy them directly from Raisely instead of using values from another organisation or article.

1. Find your Raisely Service Provider details

  1. Sign in to Raisely.
  2. Go to Organisation → SAML SSO.
  3. Expand the Admin SAML configuration card.
  4. In the Raisely Service Provider (SP) details section, copy the values into your Identity Provider.

If you also use SAML SSO for campaign websites:

  1. Expand the Campaign SAML configuration card.
  2. Copy the Campaign Service Provider values into your Identity Provider as well.
  3. If you do not see this card, turn on Use SAML SSO on campaign websites under the SAML SSO settings first.

Each card shows the values you need for that specific sign-in flow, including:

Setting What to do
Audience / Entity ID Copy this from the relevant SAML configuration card in Raisely
ACS / Callback URL Copy this from the relevant SAML configuration card in Raisely
Metadata URL Copy this from the Admin SAML configuration card if your IdP supports metadata import
SAML initiator Use Service Provider-initiated login. Raisely does not support IdP-initiated login.
NameID format Use email
Signature and Digest Algorithm Use SHA-256

2. Configure your SAML application in your IdP

In your Identity Provider, create or update the SAML application using the Service Provider values shown in Raisely.

Some Identity Providers allow multiple ACS URLs / Reply URLs and Audience / Entity IDs on the same SAML application. Others require a separate application for each Audience / Entity ID.

If your IdP supports adding multiple values to the same application:

  1. Open your existing Raisely SAML application.
  2. Add the Admin ACS / Callback URL from Raisely.
  3. Add the Admin Audience / Entity ID from Raisely.
  4. If you also use campaign website SAML, keep the Campaign values in place.
  5. Save your changes.

If your IdP requires a separate application:

  1. Create a new SAML application, for example Raisely admin panel.
  2. Set the ACS / Callback URL using the value from the Admin SAML configuration card.
  3. Set the Audience / Entity ID using the value from the Admin SAML configuration card.
  4. Set the NameID format to email.
  5. Assign the same users or groups who should be able to access the Raisely admin panel.
  6. If your IdP supports metadata import, use the metadata URL shown in the Admin SAML configuration card.
  7. Keep your existing Campaign SAML application in place if you use SAML SSO on campaign websites.

3. Provide Raisely with your IdP details

Once you have configured your SAML application, securely provide Raisely Support with your IdP configuration details.

These values must be provided directly to Raisely Support during setup and cannot be updated without Raisely Support.

Setting Description
Your domain identifier For users logging in to the Raisely admin panel, we match your organisation’s domain against a user’s email address to trigger the SAML SSO login flow, e.g. raisely.com.
Issuer details Your IdP client will have a unique issuer value, usually a URL, that Raisely uses to verify the SAML SSO connection.
Single Sign On (SSO) Endpoint The SSO entry point URL for IdP login.
Single Logout Endpoint (SLO) The SLO entry point URL for IdP logout. Optional.
Audience The IdP audience. This should match the Identifier / Entity ID configured in your IdP for the relevant Raisely SAML application.
Certificate/s Provide a certificate for the Admin application. If you also use campaign website SAML and your IdP issues a different certificate for that application, you can provide a separate Campaign certificate. If a separate Campaign certificate is not provided, the Campaign application reuses the Admin certificate.

4. Finalise your setup in Raisely

Once the above values have been added by Raisely Support, the following settings are directly configurable in Raisely.

Setting Description Notes
Allow non-SAML SSO users to be invited as Admins When switched on, you can invite non-SAML SSO users to be team members of your organisation, and they can access Raisely via username and password. Default is off.
Use SAML SSO on campaign websites If selected, new campaigns created while this setting is on will have SAML SSO automatically switched on for campaign website sign-up and login. Default is off.
Revalidation Minutes How often, in minutes, an SSO Admin user will have their roles and access revalidated. Default is 60 minutes.
Display Name What users see when redirected to your IdP. Not required.

To manage SAML SSO settings in Raisely:

  1. From the bottom of the sidebar, select Organisation → SAML SSO.
  2. Adjust the settings as needed.
  3. Select Save Changes.
  4. When you are ready to switch on SAML SSO, enable the feature by toggling it on.

Set Up User Roles and Attributes

Access to Raisely is managed by user roles. Raisely expects that organisations will manage these roles in their Identity Provider.

To understand Raisely roles and permissions, please see our support article on Managing Team Members & Permissions.

For each user that requires access to Raisely, use your IdP’s attribute mapping tool to pass the following:

Attribute Description
raiselyRoles A string of valid roles separated by ;, e.g. ORG_ADMIN or CAMPAIGN_ADMIN;FINANCE.
raiselyCampaignAssignments To assign all campaigns, add all_campaigns. For campaign-specific roles, provide a string of allowed campaign paths separated by ;, e.g. my-first-campaign;fundraising-run.

Full list of Raisely roles and SAML SSO formatting

Permission Name SAML SSO Format
Organisation Admin ORG_ADMIN
Campaign Admin CAMPAIGN_ADMIN
Manage Profiles PROFILE_EDITOR
Manage Donations DONATION_EDITOR
Manage Tickets TICKET_COORDINATOR
Manage Regular Donations SUBSCRIPTION_EDITOR
Manage Pages PAGE_EDITOR
Edit HTML/CSS TEMPLATE_EDITOR
Manage Blog Posts POST_EDITOR
Manage Users DATA_ADMIN
Manage Finance FINANCE
Manage Messages COMMS_EDITOR
Manage Campaign Settings CAMPAIGN_SETTINGS
Download Custom Organisation Reports ORG_REPORT_VIEWER
Download Campaign Reports CAMPAIGN_REPORT_VIEWER
Download Bank Payouts BANK_REPORT_VIEWER
Manage One-time and Regular Donations GIVING_COORDINATOR

Additional user attributes

You can also map user name attributes. Raisely accepts the following attributes:

  • firstName
  • lastName
  • preferredName
  • fullName

Understanding SAML SSO and Raisely

  • Once you have configured your IdP to work with Raisely’s SAML SSO setup, you still have control over turning the feature on or off.
    • Switching SAML SSO on: Once enabled, all users for your domain identifier must log in to Raisely via SAML SSO.
    • Switching SAML SSO off: If SAML SSO has already been active for your organisation, switching off the feature may affect your users’ experience. Admin SAML SSO users will be forced to reset account passwords so they can log in. If you are a SAML SSO user, your session will be cancelled, and you will be required to log in to Raisely again. If you have campaign websites with existing SAML SSO users, these users will also have to reset account passwords to access their accounts. Please be aware that if SAML SSO is switched off, users that reset their passwords will retain their roles that were set when they last accessed Raisely. If required, you should remove any old admin members directly in Raisely Team Settings.
  • Raisely requires strong passwords for logging in to Raisely. When users access Raisely via SAML SSO, we rely on your organisation to implement best practices in authentication to minimise unauthorised access to your Raisely account.
  • Users who access Raisely via SAML SSO will not have the option to turn on 2FA.
  • SAML SSO users will have sessions created on Raisely that align to their current IdP session. When the session is close to expiring, Raisely will prompt the user to reauthenticate via the IdP.
  • Raisely will periodically revalidate a user’s role and access to Raisely. The frequency can be configured using Revalidation Minutes in the SAML SSO organisation settings.
  • Although users’ roles are controlled by the IdP settings, organisation Admins still have the option of deleting SAML SSO Admin users from their Raisely team via Team Settings. Please note that if a user is still assigned roles in the IdP and logs in to Raisely, their roles will be reinstated.

Configure SAML SSO on Microsoft Entra ID

If you have chosen Microsoft Entra ID as your IdP, you can use the following tips to guide your setup.

ℹ️ If you use SAML SSO for both the Admin panel and campaign websites, repeat this setup for both the Admin SAML configuration and Campaign SAML configuration applications shown in Organisation → SAML SSO. Microsoft Entra ID requires a separate Enterprise Application per Identifier / Entity ID.

1. Basic SAML configuration

Within the SAML application in Microsoft Entra ID, set the Identifier (Entity ID) and Reply URL / ACS URL using the values shown in Raisely.

To find these values:

  1. Sign in to Raisely.
  2. Go to Organisation → SAML SSO.
  3. Expand the Admin SAML configuration card.
  4. Copy the Audience / Entity ID and ACS / Callback URL into Microsoft Entra ID.

If you also use SAML SSO on campaign websites, repeat this for the Campaign SAML configuration card.

In Microsoft Entra ID, these values are configured under:

Enterprise Application → Single Sign-On → Basic SAML Configuration

Use:

Microsoft Entra field Raisely value
Identifier (Entity ID) Audience / Entity ID from the relevant Raisely SAML configuration card
Reply URL / ACS URL ACS / Callback URL from the relevant Raisely SAML configuration card

2. Attributes & Claims

There are some key attributes you will need to pay attention to in this section. You can refer to the full list of attributes above to see the other attributes that Raisely supports.

Section Attribute Notes
Required claim Unique User Identifier (Name ID) This must be mapped to user.email.
Additional claims raiselyRoles This can be any custom field that represents your user roles.
Additional claims raiselyCampaignAssignments This can be any custom field that represents the campaigns a user should be assigned to.

⚠️ It is important that you clear any namespace value added to the raiselyRoles or raiselyCampaignAssignments attributes.

 

3. SAML Certificates

You will need to configure security settings that will be used to generate a signing certificate.

Setting Value
Signing Option Sign SAML response and assertion
Signing Algorithm SHA-256

4. Set up Raisely

When you are ready, you will need to send Raisely Support the details required to establish the connection to Raisely. In this section, we have highlighted some settings that are specific to Microsoft Entra ID. You can refer to the full list of settings above to see what else is required.

Setting Format Notes
Issuer detail https://sts.windows.net/<tenantid>/ Can be found under Enterprise Application → Single Sign-On → Set up <application name> → Microsoft Entra Identifier.
Audience A string This should match the Identifier (Entity ID) configured in Enterprise Application → Single Sign-On → Basic SAML Configuration.
Single Sign On (SSO) logon endpoint https://login.microsoftonline.com/<uuid>/saml2 Can be found under Enterprise Application → Single Sign-On → Set up <application name> → Login URL.
Single Sign On (SSO) signout endpoint https://login.microsoftonline.com/<uuid>/saml2 Can be found under Enterprise Application → Single Sign-On → Set up <application name> → Logout URL.

Use SAML SSO on Campaign Websites

Once you have SAML SSO configured and enabled on your organisation account, you can toggle on Use SAML SSO on Campaign Websites in Organisation Settings → SAML SSO → Configurable Settings.

Once this toggle is enabled, any new campaigns created while this toggle is on will allow SAML SSO on campaign websites, such as fundraiser login.

If you use SAML SSO for campaign websites, make sure the Campaign SAML configuration Service Provider values shown in Raisely are also configured in your Identity Provider.

Frequently Asked Questions

Why do I now have two SAML applications instead of one?

Raisely uses separate services for Admin panel login and campaign website login. Each service has its own Service Provider details, including its own Audience / Entity ID and ACS / Callback URL.

If you only use SAML SSO for the Admin panel, you only need to configure the Admin SAML configuration application.

If you also use SAML SSO for campaign websites, configure the Campaign SAML configuration application as well. Depending on your Identity Provider, this may mean adding the Campaign values to the same SAML application, or creating a second SAML application.

Does this affect campaign website SAML SSO?

No. Campaign website SAML SSO continues to use the Campaign SAML configuration. If you use SAML SSO on campaign websites, keep the Campaign Service Provider values configured in your Identity Provider.

Where should I copy the ACS URL and Audience / Entity ID from?

Copy these values directly from Raisely → Organisation → SAML SSO.

Use the Admin SAML configuration card for Raisely admin panel login.

Use the Campaign SAML configuration card for campaign website login and sign-up, if you use SAML SSO on campaign websites.

Can I use one SAML application for both Admin and campaign website login?

This depends on your Identity Provider.

Some Identity Providers allow multiple ACS URLs / Reply URLs and Audience / Entity IDs on one SAML application. Others require a separate application for each Audience / Entity ID.

If you’re not sure which option applies, check your Identity Provider’s SAML application settings or contact Raisely Support.

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk