SAML 2.0 SSO Integration Guide (Generic)

Guide to setting up SAML 2.0 SSO with Bucketlist Rewards

For Platform Administrators: this article is intended for Bucketlist platform administrators configuring SSO. 

This guide applies to any SAML 2.0-compliant Identity Provider (IdP) — for example Okta, Azure AD / Entra ID, Google Workspace, OneLogin, Ping Identity, JumpCloud, or a custom IdP. The configuration fields are the same across providers; only the screens and terminology used to enter them will differ.

---

1. Information you'll need to configure your IdP

When creating the SAML application in your IdP, you will be asked for the following values. These identify Bucketlist Rewards as the Service Provider (SP).

Replace <COMPANY_SUBDOMAIN> with your company's Bucketlist subdomain.

Important: Both URLs above must end with a trailing slash (/). SSO login will not work without it.

Attribute mappings

Configure the following attribute statements. The Name Format for each should be set to Unspecified.

Note: some IdPs use different default attribute names (e.g. email, firstName, lastName, or givenName/surname). Use whichever attribute in your directory holds the corresponding value — the mapping shown above uses common LDAP/Active Directory attribute names as an example.

Signing certificate

Bucketlist needs your IdP's public signing certificate to verify SAML assertions. This is provided as part of your IdP's metadata (see below), so a separate certificate upload usually isn't needed unless your IdP doesn't generate combined metadata.

---

2. Information you'll need to provide to Bucketlist

Once your SAML application is configured, export your IdP's metadata in XML format and send it to the Bucketlist product team. This file should include everything between the opening <?xml version="1.0" encoding="UTF-8"?> declaration and the closing </md:EntityDescriptor> (or equivalent root closing tag).

Once we receive your metadata, request that the Bucketlist product team enable SAML SSO for your company.

---

3. Generic step-by-step configuration guide

The exact screens vary by provider, but setting up SAML SSO with Bucketlist generally follows these steps in any IdP admin console:

1. Log in to your IdP's admin console and navigate to the Applications (or "Apps" / "Enterprise Applications") section.
2. Create a new application and choose SAML 2.0 as the sign-in / protocol method (sometimes labeled "Add custom SAML app" or "Create App Integration").
3. General settings: Give the application a name, e.g. "Bucketlist Rewards."
4. Configure SAML settings, entering the values from the table in Section 1:
   1. Single Sign-On URL / ACS URL / Reply URL
   2. Audience URI / SP Entity ID / Identifier
   3. Name ID format: Email Address
   4. Application username / Subject: Email
   5. Remember to use your correct server (US or CAD) and include the trailing slash on both URLs.
5. Add attribute statements/mappings using the table in Section 1, setting the Name Format to Unspecified where that option exists.
6. Finish creating the application, selecting whatever completion/feedback option is appropriate for your organization.
7. Assign the application to users or groups. The application will not be usable until it is assigned to the people (or groups) who should have access. Confirm that each user's username/login is set to their email address.
8. Locate and download the IdP metadata, usually found under a "Sign On," "SAML Setup," or "Federation Metadata" section of the application you created. This is typically offered either as a metadata URL or a direct XML download/copy option.
9. Send the metadata XML to the Bucketlist product team as described in Section 2, and request that SAML SSO be enabled for your company.

---

This guide is intended as a general reference for SAML 2.0 setup across identity providers. If your IdP requires provider-specific steps not covered here, please reach out to the Bucketlist support team for assistance.