Adding PandaDoc as an application in OneLogin

Sign into your OneLogin domain at <yourorganization>.onelogin.com, select 'Applications' > 'Applications' and then choose ‘Add apps’ at the top right. Select "SAML Test Connector (Advanced)" application. Set application name, e.g. “PandaDoc” and select “Save” to proceed to profile settings.

Configuring OneLogin in PandaDoc

You'll be prompted to the application settings. From here:

Switch to the Configuration tab
Fill out the following fields:
- ACS (Consumer) URL Validator: .*
- ACS (Consumer) URL: https://app.pandadoc.com/sso-acs/
Click Save
Go to the Parameters tab and select the plus button at the top right to add a parameter. By default, the first parameter is NameID with its value set to Email.
Add a parameter named FirstName, select the Include in SAML assertion checkbox, and click Save.
Next, we will assign a value for the created field. Click on the Value dropdown, select First Name, and click on Save
Similarly, we’ll add three more attributes. Add LastName and select Last Name as the value, add email, and select Email as the value. Finally, add a Workspace attribute and select Macro with "Default" as the value. Your attribute list will look as follows:
Finally, Save.

Using Rules to Provision Users to Roles and Groups

To dynamically provision OneLogin users to specific workspaces in your PandaDoc account or assign them to specific roles based on their user groups or roles in OneLogin, follow these steps:

Create Workspace attribute: Define a Workspace attribute and set it to Macro with the default workspace to which users should be assigned.
Create Role attribute: Set the Role attribute to Member.
Use Provisioning Rules: Implement provisioning rules to assign specific sets of OneLogin users to the Administrator or Manager roles based on their attributes.

You can define rules to provision subsets of your OneLogin users into PandaDoc roles and groups. For example, you can define a subset of users by filtering on a specific OneLogin user attribute value and then define an action that provisions the subset of users to a specific PandaDoc role or workspace.

Go to the Rules tab
Click Add rule to open the New Mapping dialog, where you can set the conditions and actions that determine which users will be provisioned from OneLogin to a specific PandaDoc role or workspace
Give your rule a name
In the Conditions area, click + to add a condition. Use the fields to define a condition that defines a subset of users to be acted upon by the rule. Conditions are based on OneLogin user attribute values
In the Actions area, click + to add an action. Use the fields to define the action that will be performed on users by the rule.
Click Save
To add another provisioning rule, click Add rule
The order in which rules are applied matters and can impact provisioning results. Drag and drop the rule rows to put them in the order that produces the correct results
Click Show Affected Users to see which users will be affected by the provisioning rule as configured. Review the list to ensure that only intended users are listed
Click Save
Go to the More Actions menu and click Reapply Provisioning Mappings to apply the new rule.

Warning:

You must reapply mappings any time you create or update rules!

Assigning PandaDoc Application to Users in OneLogin

After completing the configurations for PandaDoc, you need to ensure that users are assigned to the PandaDoc application. OneLogin provides various ways to assign users, for testing purposes we can assign a single user under Users > All Users > [click on user name] > Applications tab. Click the '+' sign to assign your testing user to the PandaDoc application. Additional information about assigning users to applications in OneLogin can be found in Assigning Apps to Users.

Testing SSO in PandaDoc

Log out of PandaDoc (click on avatar picture and choose “Log out”)
Open your PandaDoc URL in the browser - https://app.pandadoc.com/sso-login/
Log in with your PandaDoc account domain email.

Try out Just-in-time provisioning

Users can log in with the domain email that is not associated with a PandaDoc account through Just-in-Time provisioning. In this case, the user will be added to your PandaDoc workspace under the domain email.

Skip to: