SSO Authentication

Google Workspace

To authenticate using Google Workspace, click the Continue with Google button on the Revefi sign-in screen.
Revefi will use Google Workspace to authenticate the user.

No customer configuration is required for Google Workspace-based authentication.

Entra ID (OIDC)

To authenticate using Entra-ID (OIDC), click the Continue with Microsoft button on the Revefi sign-in screen. Revefi will use Entra-ID to authenticate the user.

Entra ID (SAML)

Prerequisite: Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

Create SAML application in Entra ID

1. Go to Entra ID → Enterprise apps → New application.
2. Select Create your own application.

3. Name the app
   revefi-acme-app

4. Select Integrate any other application you don't find in the gallery (Non-gallery) → Create.

Configure SAML single sign-on

5. In the new app, go to Manage → Single sign-on and select SAML.

6. On Basic SAML Configuration, select Edit and enter the values Revefi supplied:

7. Select Save.

Configure claims

8. On Attributes & Claims, select Edit.
9. Leave the default additional claims in place. Revefi consumes the standard Entra claim set:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress → user.mail
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → user.givenname
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → user.surname
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name → user.userprincipalname

Signing certificate

10. On SAML Certificates, select Edit next to the token signing certificate and confirm:

• Signing Option: Sign SAML response and assertion
• Signing Algorithm: SHA-256

11. Save, then Download the Certificate (Base64) file.
12. Copy the App Federation Metadata Url

Record the IdP endpoints

13. In the Set up
    revefi-acme-app
    panel, copy and retain:
    1. Login URL
    2. Microsoft Entra Identifier
    3. Logout URL

Assign users

14. Go to Manage → Users and groups → Add user/group.

Send to Revefi Support

Email the following to

• Certificate (Base64) file
• Login URL
• Microsoft Entra Identifier
• Logout URL
• The connection name used (
  revefi-acme-app
  )

Okta SAML

Using Okta SAML authentication requires configuration. After setup, users can authenticate with Okta SAML through the Revefi sign-in screen.

Configuration

Reach out to

[email protected]

for any questions.

Okta SAML configuration is a two-step process.
The initial steps are performed by your team, and once completed, Revefi will finalize the setup.

Initial Steps — Customer Creates the Revefi Application in Okta

In these steps, replace the

• Log into your Okta environment.
• Click the Admin button in the top right.
• From the Okta bar, click Applications → Applications.
• Click Create App Integration.
• Select SAML 2.0 and click Next.
• Choose the app name as
  revefi-acme-app
  .
• Click Next.
• Enter the following in the Single sign-on URL text box:
  https://auth.revefi.com/login/callback?connection=revefi-acme-app
• Enter the following in Audience URI:
  urn:auth0:revefi:revefi-acme-app
• Change Name ID Format to EmailAddress.
• Change Application username to email.
• Click Next.
• Select I’m an Okta customer adding an internal app.
• Click Finish.
• In the Sign On tab, download the SHA-2 certificate generated for the app (Actions → Download certificate).
• Go to the Assignments tab.
• Click Assign → Assign People.
• Search for the user(s) you want to allow to log in to the Revefi app.
• Click the Assign button next to each user’s name.
• Click Save and Go Back.
• In the General tab, copy the URL from the App Embed Link section.
• Send the following information to Revefi:
  • The SHA-2 certificate that was generated.
  • The App Embed Link URL.
  • Your Okta app name (
    revefi-acme-app
    ).

Next Steps — Completed by Revefi

Once you have completed the initial steps, contact

Passcode-Based (Passwordless) Authentication

Email-Based Authentication

Enter your email address in the Revefi sign-in screen. Revefi will send a one-time-use passcode to your email.
Enter this pass-code to log in.

No customer configuration is required for email-based authentication.

FAQ