Understand what SAML single sign-on does   

SAML is especially useful when a superhost wants authentication to stay aligned with the organization’s existing login system. Instead of asking members to maintain separate credentials, CommunitySpaces can trust the identity provider to verify the user and allow access accordingly.  

Know who can enable SAML   

Only hosts can enable SAML in a community. This restriction exists for security reasons, since SAML affects how members authenticate into the entire community.  

Keep the required details ready   

Before starting the configuration, keep these details ready from your identity provider:

• Login URL

• Logout URL

• Entity ID

• Default Relay

• Verification certificate  

 The setup example uses Zoho Vault as the identity provider, but you can use your own identity provider if you already have one.   

Copy CommunitySpaces service provider details   

To begin the setup, open SAML in the Single Sign-On settings and click Configure.

On this page, copy the CommunitySpaces service provider details shown there:

• Entity ID

• ACS URL

• SP Logout URL

• Default Relay URL  
  

These values must be entered in your identity provider so it can recognize Zoho CommunitySpaces correctly as the service provider.

Configure your identity provider   

After copying the service provider values from CommunitySpaces, go to your identity provider and create or configure the SAML application for your community.

In the Zoho Vault example, you create a Custom App, then map the values from CommunitySpaces like this:

1. Go to https://vault.zoho.com/ and log in to Zoho Vault.

2. Click Apps from the left menu and go to Manage Apps.
   
   

3. You need to create a custom app. Click the search bar and enter any keyword. In the search results, click Create Custom App.
   
   
   
   

4. Enter your application name and paste the copied entities from Zoho CommunitySpaces as follows:

• ACS URL → Assertion consumer service URL

• SP logout URL → Logout URL

• Audience URI → Entity ID

• Default Relay State → Default Relay State  

Once that configuration is completed in the identity provider click Next, copy back these values from the identity provider:

• Login URL

• Logout URL, if auto logout is enabled

• Certificate  

If you copy the certificate as text, save it on your device in a supported format such as .cert, .crt, .cer, or .pem before uploading it in CommunitySpaces.  

Complete the SAML setup in Zoho CommunitySpaces   

Return to Community Settings > Single Sign-On > SAML and enter the identity provider details into the CommunitySpaces configuration.

Map the values like this:

• Login URL → Login URL

• Logout URL → Logout URL

Then, under Verification Certificate, click Upload and upload the certificate file you saved earlier.

After that, choose the required Auto User Provisioning preference and click Save. In the confirmation popup, click Save again to complete the setup.  

This is the final configuration step in CommunitySpaces. Once saved, SAML becomes the sign-in method configured for the community.

Superhost and Hosts can still sign in using their community credentials.

Grant users access in the identity provider   

After the SAML configuration is saved in CommunitySpaces, make sure users are actually granted access to the SAML application in your identity provider. This is a required step.

In the Zoho Vault example, you return to the app, click Grant User Access.

Select the users, click Grant Access, and then click Done.  

This step is important because even if SAML is configured correctly, users still need access to the application inside the identity provider before they can sign in through SSO.

Disable, edit, or delete the SAML configuration   

Once SAML is configured, you can manage it anytime from Community Settings > Single Sign-On > SAML.

Use the toggle to disable SAML temporarily. While SAML is disabled, members must use the regular login method instead.  

Use Edit Configuration when you want to update the existing setup, such as when switching to a new identity provider or changing the SAML details. Make the required changes and click Save.  

Use the trash icon when you want to delete the configuration permanently. Then click Delete configuration in the popup to confirm.  

Deleting the SAML configuration permanently removes all data linked to it. If you only want to stop using SAML for a while, disable it instead of deleting it.