Adding the FotoWeb application to your SAML provider

This article describes how to register FotoWeb as an application with your SAML identity provider (IdP) and how to complete the corresponding configuration on the FotoWeb side in the Operations Center Settings app.

Microsoft Entra ID and Okta are used below as worked examples. The same values apply to any SAML 2.0 identity provider — only the field names and the location of the settings in the provider's management console vary.

Values FotoWeb needs from your identity provider

Create an application in your SAML provider's management console and set the following parameters. These values are the same for every identity provider, including Microsoft Entra ID and Okta.

Single sign-on URL

Also known as the Assertion Consumer Service URL (ACS URL).

Use the hostname of your FotoWeb server, followed by /fotoweb/auth/saml20/consume/, for example:

https://example.fotoware.cloud/fotoweb/auth/saml20/consume/

Issuer ID / Audience URI

In FotoWeb 8.0 build 837 and newer, the Audience URI must match the correct Issuer ID — the site URL — including a final forward slash, as in the following example:

https://example.fotoware.cloud/fotoweb/

In earlier versions of FotoWeb, the Audience URI must read FotoWeb.

User attributes

FotoWeb expects the following four attributes from the identity provider. You map them to the equivalent claim or attribute in your provider in the steps below.

Example: Microsoft Entra ID setup

Basic SAML configuration

User attributes & claims

Microsoft Entra ID supports different claim types and custom claim mappings. The examples below are commonly used values, but your organization's requirements may differ.

Optional: custom claims

You can map any additional Entra claim to a FotoWeb field to import more information about your users. For example, the employee ID claim can be mapped to the FotoWeb Description field:

This mapping is an example only — which additional claims you send and where you map them depend on your organization's requirements.

Optional: importing group membership

To import users' group membership into FotoWeb, add a group claim in the Entra Attributes & Claims section.

1. In the enterprise application, open Single sign-on and then Attributes & Claims.
2. Select Add a group claim.
3. Choose which groups to return in the claim. Selecting Groups assigned to the application limits the claim to the groups you have assigned to FotoWeb, keeping the token small and avoiding sending unrelated groups.
4. Set Source attribute. This choice decides what the claim actually contains, and therefore what you must enter in FotoWeb later, so note which one you pick:
   • Group ID sends each group's Object ID — a GUID such as 8a5b1c94-3f2d-4e77-b0a1-6d9c2f31e8ab. The value is stable: it does not change if the group is renamed.
   • Cloud-only group display names sends each group's name, such as Marketing. This is easier to read, but the value changes if the group is renamed in Entra ID, which breaks the link to FotoWeb.

In this example, the source attribute is set to Cloud-only group display names, so the claim carries group names.

Whatever this claim sends is the value FotoWeb matches on. When you link the group in FotoWeb, enter that same value as the External Group ID: the Object ID if you chose Group ID, or the group name if you chose a display-name option. For the FotoWeb side of the configuration, see Managing groups using SAML.

Certificate

Download Certificate (Base64) from the SAML Signing Certificate section in Microsoft Entra ID. You upload this into the X.509 Certificate field in FotoWeb — see Configuring FotoWeb below.

Assign users and groups

In the enterprise application, open Users and groups and assign the users or groups that should be able to sign in to FotoWeb. Users who are not assigned will be denied access by Entra ID before FotoWeb ever sees the request.

Test the connection

Once the FotoWeb side is configured, use Test this application in Entra ID to verify the connection with an assigned test account before rolling the change out to users.

Example: Okta setup

Create the application in the Okta management console using the values from Values FotoWeb needs from your identity provider above.

In the Attribute statements section, map the FotoWeb attributes to those of your SAML provider. The screenshot below shows the mapping between FotoWeb and Okta, with the FotoWeb attributes listed in the left column (email, givenName, sn, username) and the corresponding Okta values in the right column.

Configuring FotoWeb

After setting up the application, the SAML provider will provide you with an endpoint URL to which FotoWeb will send authentication requests, along with an X.509 certificate. These must be copied into the SAML authentication settings in the FotoWeb site configuration in the Operations Center Settings app, as shown below.

Setting the Logout URL

The Logout URL can be obtained from the IdP.

If the user logs out from FotoWeb or the session is terminated by other means, they will be redirected to the custom logout URL.

The custom logout URL may be a "start page" with links to FotoWeb and other applications that the user can log in to via SAML. For example, services such as Microsoft Entra ID, Okta, Google Workspace, and ADFS can have such pages. When using sign-in initiated by the identity provider (where the user signs in to FotoWeb from an external page rather than the FotoWeb login page), this provides a more natural experience, in which the user returns to the "start page" after leaving FotoWeb.

The custom logout URL is used regardless of whether the FotoWeb login page is enabled or not ("always log in with SSO"). This may be useful in cases where most users are expected to log in via SSO, but a select few (typically administrators) log in via the FotoWeb login form.

If no custom logout URL is specified and the FotoWeb login page is disabled ("always log in with SSO"), the user is redirected to a default page after logout, which includes a link to log back in via SSO.

Enforcing the use of SAML for login

• Only allow login with SAML selected — users who access FotoWeb are not prompted to enter a username and password; they are immediately authenticated via SAML when accessing the site.
• Only allow login with SAML cleared — it will be possible to enter a FotoWeb username and password manually to log in. To log in with SSO, select Login with SSO on the login screen; you cannot manually enter your SAML credentials.

Troubleshooting