> ## Documentation Index
> Fetch the complete documentation index at: https://docs.camo.ag/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On

**Overview**

The CamoAg platform supports SAML as a well-known authentication single sign-on protocol.

**Customer to CamoAg**

We require the following information from a customer to enable SAML single sign-on:

* SAML Metadata XML
* Email domains governed by organization SSO (e.g. @camo.ag)

**Customer Configuration**

Once this is sent to CamoAg, the customer would need to setup the following SAML app in their authentication provider, where “**`<custom-code>`”** would be replaced by your white-label sub-domain (e.g. **acme.camo.ag** would use **acme**).

**CamoAg**

* Entity ID:  **[https://app.camo.ag/sp](https://app.camo.ag/sp)**
* ACS URL: **`https://app.camo.ag/api/auth/saml/acs/<custom-code>`**

**Example Acme config:**

* Entity ID:  **[https://app.camo.ag/sp](https://app.camo.ag/sp)**
* ACS URL: **[https://app.camo.ag/api/auth/saml/acs/acme](https://app.camo.ag/api/auth/saml/acs/acme)**

**SAML Attribute mapping**

CamoAg requires the first name and last name of single sign-on users, which may need to be configured within the Customer’s SAML app. Customers should make sure these attributes are configured to be provided. CamoAg supports [Microsoft Active Directory](https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-profile-attributes) attributes and the following standard attribute name conventions for the following:

* First Name - Required (“first\_name”, “first name”, “givenName”)
* Last Name - Required (“last\_name”, “last name”, “surname”)
* Department - Optional (“department”)
  * If provided, used for SSO read-only user groups for engagement analytics segmentation, and permission granularity for features and reporting
* Supervisor - Optional (“supervisor”)
* Title - Optional (“title”, “jobTitle”)

## Troubleshooting

### Google returns a 403 SAML error

If your organization uses Google as its identity provider, users may see a Google-branded error page instead of CamoAg's after clicking **Sign in with SSO**:

```
403. That's an error.

Error: app_not_configured_for_user
Service is not configured for this user.
```

The tab title reads **Error 403 (SAML Error)**.

This page is served by Google, not CamoAg — the sign-in never reached CamoAg. Google is reporting that the Google account the browser is currently signed in with isn't authorized to use CamoAg. Most often the browser is signed in with a personal Google account (for example, a Gmail address) rather than a work account on the organization's domain. This is common on shared devices. Clearing browser history won't help, because the wrong account is still signed in.

<Steps>
  <Step title="Sign in to the browser with the work Google account">
    Go to [accounts.google.com](https://accounts.google.com), sign out of every account, then sign back in with the work email on your organization's domain. If the browser has a profile picker, switch to the profile tied to the work account.
  </Step>

  <Step title="Return to CamoAg and sign in again">
    Open your organization's CamoAg URL and click **Sign in with SSO**. Google should now hand you off to CamoAg without an error.
  </Step>
</Steps>

If the work account is already the one signed in and `app_not_configured_for_user` still appears, the Google Workspace admin hasn't granted that account access to the CamoAg SAML app. Contact your IT or Workspace administrator and ask them to enable CamoAg for the user.