Setting up SSO for OneLogin

In the OneLogin admin panel, go to Applications and click on Add App:
​

​

Search for SAML and select the SAML Custom Connector (Advanced):
​

​

Set the app name and logo, then click Save:
​

​

Click on the Configuration section and you will be presented with a list of values that need to be provided, we will get these values from Toggl.
​

Open the Toggl Profile Settings and click on Create SSO Profile
​

Set the profile name and the company domain:
​

​
​Note the ACS URL and the Entity ID - we will use them shortly.
​

Go back to OneLogin Settings and use the values obtained from Toggl to fill in the Audience (EntityID) and ACS (Consumer) URL. For the ACS (Consumer) URL Validator you can use the following value:
​

Note: if you need your users to begin the SSO flow from your side (also known as Identity Provider initiated login) instead of doing so at https://accounts.toggl.com/track/sso-login/ you should append ?toggl_product=track at the end of the "ACS (Consumer) URL" field, and you should modify "ACS (Consumer) URL Validator" by using ^https:\\/\\/accounts\\.toggl\\.com\\/api\\/sso\\/acs\\/\\d+

Scroll down and also set:
​
​SAML initiator to Service Provider
​SAML nameID format to Email
​SAML signature element to Response (please do not set this to Assertion to avoid issues
​

Click Save
​

Go to the SSO tab copy the Issuer URL:
​

​

Go back to Toggl SSO profile configuration, tick the "I have access to an IdP metadata URL", and paste the URL:
​

​

Click on Submit for review
​

At this point you are done with the configuration. Please allow some time for the Toggl Support team to verify the configuration and that you are eligible to use the selected domain. Once the verification process gets completed, you will be notified by email.