--- title: "Single sign-on (SSO)" slug: "single-sign-on-sso" description: "Learn how to configure SSO in Zilliant CPQ. " tags: ["SAP Cloud Platform", "SSO", "Zilliant CPQ"] updated: 2026-05-06T09:25:34Z published: 2026-05-08T10:00:29Z canonical: "docs.zilliant.com/single-sign-on-sso" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.zilliant.com/llms.txt > Use this file to discover all available pages before exploring further. # Single sign-on (SSO) Configure single sign-on (SSO) to use your company's identity provider (IdP) to authenticate users to Zilliant CPQ. Enabling authentication through SSO simplifies and secures user access to CPQ when integrated into various CRM platforms like Salesforce, SAP SalesCloud, and Microsoft Dynamics. When embedding CPQ into CRM solutions, SSO provides multiple advantages: - **Seamless user experience** - Enables user access to CPQ from their CRM without the need to sign in separately. - Improves productivity by eliminating the need for multiple login credentials. - **Unified authentication and security** - Ensures that only authorized users in the CRM can access CPQ, reducing the risk of unauthorized access. - Leverages existing authentication frameworks like OAuth 2.0, SAML, or OpenID Connect to enforce security policies. - **Context-aware access and data integrity** - By using CRM session credentials, SSO ensures that user roles and permissions remain consistent across platforms. - Prevents data silos by synchronizing sales quotes, pricing, and approval workflows across the integrated ecosystem. - **Simplified IT management and compliance** - Reduces administrative overhead by centralizing user access control in the CRM's IdP. CPQ uses [AWS Cognito](https://aws.amazon.com/cognito/) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/external-link-svgrepo-com.svg?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) to enable SSO. Amazon Cognito integrates with identity providers such as SAML, OpenID Connect, and OAuth 2.0. It enables users to authenticate using enterprise directories (such as Microsoft Entra ID), social logins, or custom authentication solutions. The following sections provide general steps, examples, and resources to help you configure SSO: - [General SSO integration](/v1/docs/single-sign-on-sso#general-sso-integration-saml-20) - [Configure attribute mapping](/v1/docs/single-sign-on-sso#configure-attribute-mapping) - [Customize the SSO user-not-found message](/main/docs/single-sign-on-sso#customize-the-sso-usernotfound-message) - [Example: SAML 2.0 configuration in Salesforce-connected apps for CPQ integration](/v1/docs/single-sign-on-sso#microsoft-entra-id-azure-ad-saml-configuration) - [Example: Visual configuration](/v1/docs/single-sign-on-sso#example-visual-configuration) - [Resources](/v1/docs/single-sign-on-sso#resources) --- ## General SSO integration (SAML 2.0) Use the following general steps to set up SAML 2.0-based authentication for CPQ: 1. Submit a request to Zilliant Support to set up SSO integration. Zilliant responds with the following SAML 2.0 configuration details to enable setup: - **Entity ID**—Unique identifier for CPQ as a service provider. - **Reply URL**—Endpoint in CPQ that receives SAML authentication responses (assertions) from the identify provider (IdP). 2. Sign in to your IdP solution, such as Microsoft Entra ID, Okta, or Salesforce. 3. Create a SAML application for CPQ. 4. Add the **Entity ID** and **Reply URL** provided by Zilliant to the new SAML application. 5. [Configure attribute mapping](/v1/docs/single-sign-on-sso#configure-attribute-mapping) in the IdP to ensure users are correctly authenticated and authorized. 6. Download the IdP metadata file and share it with Zilliant Support. The IdP metadata file contains: - SAML SSO URL - Certificate (X.509) - Issuer (IdP Entity ID) - Attribute mapping details Zilliant responds with the CPQ Service Provider (SP) metadata file, which includes: - Entity ID - ACS URL - SAML certificate - Other required metadata 1. Upload the SP metadata file to your IdP solution. This establishes the trust relationship between your IdP and CPQ. 2. Initiate a test login from your IdP to CPQ to validate the SAML authentication flow. If you encounter issues, use debugging tools such as SAML Tracer, Okta system logs, Microsoft Entra sign-in logs, or Salesforce event logs to identify configuration issues. After validation, SSO is activated and you can use your enterprise credentials to sign into CPQ through your IdP. --- ## Configure attribute mapping > [!NOTE] > Before you continue > > The common attribute used for authentication across all IdP solutions should match the usernames in CPQ. #### Primary attribute Recommended and most commonly used as the primary identifier: `email`—User's email address. #### Alternative attribute If email is not used: `username`—Unique user identifier that matches the usernames configured in CPQ. #### Other attributes Optional but recommended for additional user context: - `firstName`—User's first name. - `lastName`—User's last name. #### Attribute mapping examples Expand to view examples for each IdP. ****Okta**** - **Primary**—email - **Alternative**—username ****Microsoft Entra ID (Azure AD)**** - **Primary**—userPrincipalName (frequently the user’s email address) - **Alternative**—sAMAccountName ****Salesforce (SAML Connected App)**** - **Primary**—email - **Alternative**—FederationIdentifier --- ## Customize the SSO user-not-found message When a user signs in through SSO but no matching user account exists in Zilliant CPQ, the system displays an error message. You can customize this message to provide clearer guidance for your users, such as who to contact or what steps to take next. To configure a custom message, add the `security.sso.userNotFoundMessage` property to the `application.properties` file. If you don’t define this property, CPQ uses the default message. > [!NOTE] > Tip > > The `security.sso.userNotFoundMessage` property supports HTML formatting, so you can include styled text and links in the message. To configure a custom message: 1. Follow the steps in [General property and ontology files](/main/docs/general-property-and-ontology-files#access-properties-and-ontology-files) to download the `application.properties` file from the **conf** folder. 2. Add the following property to the file with your custom message. If needed, use HTML in the property value to format the message or add links. ```xml security.sso.userNotFoundMessage=Your custom message ``` 1. Upload the updated `application.properties` file back to the **conf** folder. 2. Restart the system for the change to take effect. Now, if a user signs in through SSO and no matching user is found in Zilliant CPQ, the system displays your custom message. ****Example message**** ```xml # SSO user not found error security.sso.userNotFoundMessage=

Contact our Support and submit an access request. For details, read How to request access.

``` --- ## Example: SAML 2.0 configuration in Salesforce-connected apps for CPQ integration This example highlights specific considerations for integrating Salesforce as the IdP with CPQ as the service provider. When configuring Salesforce-connected apps for SAML 2.0 authentication, ensure the following critical details are correctly set. ### Key configuration points #### Start URL This URL must be customized to CPQ URL + `/quotelist`. For example: `https://your-cpq-instance.zilliant.com/quotelist` Salesforce does not automatically handle paths, so you must manually append `/quotelist` to the CPQ URL. This ensures users are directed to the correct application endpoint after authentication. #### SAML service provider settings - **Entity ID**—Provided by Zilliant. Example: `urn:amazon:cognito:sp:your-region_your-instance-id`. - **Assertion Consumer Service (ACS)**—Provided by Zilliant. This is the endpoint where Salesforce sends authentication responses. Example: `https://your-cpq-instance.zilliant.com/saml2/idpresponse`. - **Issuer**—Autofilled. This is the unique identifier for your Salesforce organization. Example: `https://your-salesforce-org.salesforce.com`. #### Name ID format This attribute is used for authentication. It must match the attribute used for user identification in CPQ. Typically: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. #### IdP certificate Part of the metadata download. Upload the appropriate SAML certificate for your IdP. This certificate must match the one configured in Salesforce Connected Apps. #### SAML login information Auto-filled and part of the metadata download. Key endpoints in Salesforce: - **IdP-Initiated Login URL**—Used for direct IdP-initiated logins. Example: `https://your-salesforce-org.salesforce.com/idp/login?app=your-app-id`. - **SP-Initiated POST Endpoint**—Used when authentication is initiated by CPQ. Example: `https://your-salesforce-org.salesforce.com/idp/endpoint/HttpPost`. - **SP-Initiated Redirect Endpoint**—Example: `https://your-salesforce-org.salesforce.com/idp/endpoint/HttpRedirect`. - **Metadata Discovery Endpoint**—Example: `https://your-salesforce-org.salesforce.com/.well-known/samlidp/your-app-id.xml`. #### Custom Connected App Handler If needed, configure a custom Apex plugin class for additional logic or advanced flows. --- ## Example: Visual configuration The following image demonstrates the configuration screen in Salesforce’s connected apps setup. It includes the **Start URL**, **Entity ID**, **ACS URL**, and **Issuer** fields. The emphasis is on ensuring that Start URL correctly directs users to the CPQ `/quotelist` endpoint. ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(425).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) --- ## Resources The following technical and documentation resources may be helpful when setting up SSO. ### Microsoft Entra ID (Azure AD) SAML configuration - [Set up a SAML 2.0 provider with Microsoft Entra ID](https://learn.microsoft.com/en-us/power-pages/security/authentication/saml2-settings-azure-ad) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(423).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) - [Single sign-on SAML protocol](https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-on-saml-protocol) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(424).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) ### Okta SAML configuration - [Add a SAML 2.0 IdP](https://help.okta.com/en-us/content/topics/security/idp-inbound-saml-workflow.htm) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(424).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) - [Understanding SAML](https://developer.okta.com/docs/concepts/saml/) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(424).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) ### Salesforce SAML configuration (connected app) - [Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=sf.sso_saml.htm) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(424).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) - [Single Sign-On](https://developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/sso_about.htm) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(424).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D) ### General SAML 2.0 technical overview [SAML 2.0 Technical Overview (OASIS)](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html) ![](https://cdn.document360.io/24f960e8-3c1c-4c18-a2c6-83b6ae4aab84/Images/Documentation/image(424).png?sv=2026-02-06&spr=https&st=2026-11-14T00%3A03%3A32Z&se=2026-11-14T01%3A03%3A32Z&sr=c&sp=r&sig=2BlIV8eGLl4FLYcAMJTxMmt157gs6QzTEJJg2bzRS58%3D)