When setting up BravoTran with a SAML Identity Provider (IdP from now on), you must add BravoTran as a Service Provider (SP from now on) to the IdP.

IdP Setup

To add your BravoTran account to an existing IdP, you must first provision that account as a SP within the IdP. The specifics of this process depend on the IdP, but at the end of the process, you should be able to provide the following to BravoTran:

• An X.509 Certificate or its SHA1 fingerprint
• An IdP Entity ID
• An IdP SSO URL
  • BravoTran currently supports the urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST SSO Service Binding
• An IdP SLO URL
  • BravoTran currently supports the urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect SLO Service Binding.

BravoTran URIs for IdP Setup

Replace <Service Provider ID> below with the ID BravoTran gives you:

• Metadata or Application ID URI: https://www.bravotran.com/saml/<Service Provider ID>/metadata
• Consumer or Redirect URI: https://www.bravotran.com/saml/<Service Provider ID>/consume
• Single Logout URI: https://www.bravotran.com/saml/<Service Provider ID>/logout

IdP Provider-Specific Documentation

Microsoft Entra

• https://learn.microsoft.com/en-us/entra/identity/saas-apps/saml-toolkit-tutorial
• https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal
• Note that Entra may, by default, enable the experimental feature “SAML Request Signature Verification.” BravoTran SSO does not support signing outgoing SAML requests, so this setting must be disabled.
• To get your X.509 Certificate from Entra to send to BravoTran, refer to step 6 in this documentation:
  • https://learn.microsoft.com/en-us/entra/identity/saas-apps/saml-toolkit-tutorial#configure-and-test-microsoft-entra-sso-for-microsoft-entra-saml-toolkit

Appendix