This article is also available in:

Set up SAML single sign-on (SSO) for SimplyPrint

SAML single sign-on (SSO) lets your school, enterprise, or print farm connect SimplyPrint with your existing identity provider (IdP), such as Google Workspace, Microsoft Entra (Azure AD), Okta, OneLogin, Auth0, or education-focused IdPs like Shibboleth. Your members log in with the same account they already use at school or work, no extra passwords needed.

This is the SAML setup guide. SimplyPrint also supports OpenID Connect (OIDC), and your account can run either one. New to SSO, or not sure which to use? Start with the single sign-on overview, which compares SAML and OIDC and links every setup guide.

Single sign-on is included in the Enterprise plan and the School plan. Print Farm accounts that subscribed before 2026-05-15 keep SSO as well.

Tip: if you or anyone from your team already has a SimplyPrint account, created without SSO, you can link your account after setting up SSO! More here: Linking your existing SimplyPrint account to your SSO account

Using Google Workspace, Microsoft Entra ID, Okta or Auth0?

Check out our provider-specific SAML guides:

Federation: InCommon, eduGAIN, WAYF or any other InCommon or eduGAIN members: Set up Federation-based SAML Single Sign-On (SSO) for SimplyPrint
Google Workspace SSO setup guide: Set up Google Workspace Single sign-on (SSO) for SimplyPrint
Microsoft Entra SSO setup guide: Setting up SAML Single Sign-On (SSO) with Microsoft Entra ID for SimplyPrint
Okta SSO setup guide: Set up Okta single sign-on (SAML) for SimplyPrint
Auth0 setup guide: Set up Auth0 Single Sign-On (SSO) for SimplyPrint

Otherwise, here's a general guide that applies to all IdP SSO providers.

How SimplyPrint identifies users

SimplyPrint identifies each member by the SAML NameID your IdP sends in the assertion, not by email. Email, name, and groups are attributes that can change at any time without affecting the account, so a member's email can change and they stay the same SimplyPrint user.

Our service metadata requests the persistent NameID format. When you configure your IdP, release a stable, non-reassignable identifier as the NameID, for example a NetID, an eduPersonPrincipalName, or a persistent per-user ID, rather than a value that could later be reused for a different person.

Step 1: Get your SimplyPrint metadata

Every SimplyPrint organization has a unique metadata file. This metadata describes SimplyPrint as a “Service Provider (SP)” and is required when setting up the connection inside your Identity Provider (IdP).

Go to Organization Settings → Registration & SSO in SimplyPrint.
Under SAML Single Sign-On (SSO), click Edit SAML Configuration.
At the top of the popup, you’ll see a link to your unique metadata file, like: https://simplyprint.io/saml/[your-account-id]/metadata

This file contains everything your IdP needs to know about SimplyPrint:

SP Entity ID
Assertion Consumer Service (ACS) URL (where login responses are sent)
Supported bindings (Redirect and POST)
Logout URL (if supported)

👉 In most IdPs, you can either upload this XML file directly or copy the values into your SAML app configuration.

Step 2: Configure SimplyPrint with your IdP details

Once SimplyPrint is registered in your IdP, you’ll need to provide SimplyPrint with your IdP’s information.
In Organization Settings → Registration & SSO → Edit SAML Configuration, fill in:

Entity ID (Issuer) – The unique identifier from your IdP.
- Example values often look like:
- - https://sts.windows.net/12345678-aaaa-bbbb-cccc-1234567890ab/ (Microsoft Entra)
  - https://accounts.google.com/o/saml2?idpid=C012345 (Google Workspace)
  - https://idp.yourschool.edu/idp/shibboleth (Shibboleth)
  - https://wayf.dk ("Where are you from", Denmark)
X.509 Certificate – The signing certificate from your IdP (starts with -----BEGIN CERTIFICATE-----).
SSO URL (Login URL) – The login endpoint your IdP provides.
- Typically looks like:
- - https://login.microsoftonline.com/.../saml2 (Microsoft)
  - https://accounts.google.com/o/saml2/idp?idpid=... (Google)
  - https://idp.example.edu/idp/profile/SAML2/Redirect/SSO (Shibboleth)
SSO Binding – Most IdPs use HTTP-Redirect, but some require HTTP-POST.

Step 3: Map user attributes

SimplyPrint needs to know which IdP attributes correspond to user information.

Required mappings

User data	Example attribute in IdP	Notes
Full Name	`displayName`, `name`	Optional if using First + Last
First Name	`givenName`, `urn:oid:2.5.4.42`, `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`	Required
Last Name	`sn`, `surname`, `urn:oid:2.5.4.4`, `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`	Required
Email	`mail`, `userPrincipalName`, `urn:oid:0.9.2342.19200300.100.1.3`	Optional
👉 Attribute names may look clean (`givenName`) but sometimes they are technical OIDs or SOAP schemas. This is normal.

Optional mappings for all organizations

User data	Example attribute in IdP	Notes
User Group	`groups`, `department`, `memberOf`	Lets you assign users to groups in SimplyPrint

Additional mappings for schools

User data	Example attribute in IdP	Notes
School: Is teacher	`isTeacher` → `true/false` or `yes/no`	Flags a user as a teacher. Defaults to `false` if not set.
School: Classes	`eduClass`, `memberOf`, or custom attribute	Can be multiple values or a delimited list. Values map to SimplyPrint classes defined in your school’s settings.

Step 4: Save and test the connection

Click Save in SimplyPrint.
Log out and try logging in using the new SAML SSO option.
If login fails:
- Double-check your Entity ID, SSO URL, and certificate.
- Ensure attribute mappings match what your IdP provides.
- Try switching the SSO binding (Redirect ↔ Post).

To make it easy for users to find you when signing in:

Go to Organization Settings → Registration & SSO (https://simplyprint.io/panel/settings/organization#registration)
Enable “Show school/organization in the public list shown on login page.”
Your organization will now appear in the dropdown list at:
- https://simplyprint.io/panel/login
- https://simplyprint.io/panel/login/school

Example scenarios

Schools:
- Students and teachers log in with their school accounts.
- Teachers are automatically flagged using the isTeacher attribute.
- Students can be assigned to classes from the classes attribute.
Enterprises / print farms:
- Employees use corporate logins (Okta, Entra, OneLogin).
- Groups from the IdP can be mapped to SimplyPrint roles.

Link existing accounts (email & password signups) to an SSO account

If you, members of your team or students have already signed up for your SimplyPrint organization without SSO, by simply registering on our site with their name, email and password, they can link that account to SSO.

Learn how to here: Linking your existing SimplyPrint account to your SSO account

Issues? Troubleshoot your SSO integration here!

Visit our "SSO troubleshooting" guide for troubleshooting help: SSO troubleshooting: how to fix errors like "first_name not set"

Updated on: 07/07/2026

Was this article helpful?

Thank you!