Set Up SAML Configurations with Your Identity Provider for SSO – Proof Help Center
This article details the necessary SAML configuration data and user attribute mappings that an organization's identity provider must set up to enable domain-based single sign-on (SSO) with Proof, including required URLs, entity IDs, and specific user attributes like name, email, roles, and organization IDs to provision and assign roles within Proof's system.
Audience: Organizations
Domain-based single sign-on (SSO) enables your users to log in to multiple applications using a single username and password. This article covers the SAML data and attributes your identity provider (IDP) needs to connect to Proof.
This is step 3 of the domain-based SSO setup.
Proof SAML Data
The identity provider (IDP) needs the following Proof SAML data configured:
- Entity (or issuer) ID:
https://api.proof.com/saml/consume - Assertion Consumer Service (ACS) URL:
https://api.proof.com/saml/consume - SP metadata URL:
https://api.proof.com/saml/metadata - SAML attributes: These attributes sent from the IDP to SP help Proof provision accounts, assign specific roles (organization admin, organization notary), and create users in the desired child organizations.
Attributes
- nameid (required): A unique immutable identifier for the user
- first_name (required): User's first name
- middle_name (optional, strongly recommended): User's middle name. Strongly recommended as middle names help users pass KBA when signing documents.
- last_name (required): User's last name
- name (optional): User's full name (e.g., "John Patrick Smith Jr.")
- email (required): User's email
- roles (optional but recommended): Assign specific roles to a user in your organization's Proof account. Possible values:
- Admin
- Notary (assigns the in-house notary role)
- Employee (assigns the team member role)
- User_manager
- Tech_support
- Sender
If omitted for new users, the role defaults to employee. If omitted for existing users, the role does not change. Multiple roles can be assigned, e.g.,
[employee, notary],[notary, admin].
- organization_id (optional): A Proof organization external ID (e.g.,
or_ojw8gkq). Useful for companies with a root organization with multiple parent/child organizations. If specified, the user is added to that organization. If not specified, the user is added to the organization that configured the SSO. - notary_state (optional — required if role includes notary): The abbreviation of the notary's commissioned state (e.g.,
notary_state: AZ). - notary_languages (optional — required if role includes notary): An array of languages spoken by the notary. Supported values:
en= Englishes= Spanish More than one language can be selected, e.g.,[en],[en, es].
Create Custom Attributes
If your IDP does not support sending the default attribute names (e.g., your IDP sends given_name instead of first_name), you must configure custom attribute mapping in Proof.
Steps:
- 1.Select Security from the left navigation panel.
- 2.Select Identity providers from the Access page menu on the left.
- 3.Select Configuration details for the identity provider you'd like to edit.
- 4.Select Actions in the upper right corner.
- 5.Select Configure attribute mapping.
- 6.Select + Add custom mapping.
- 7.Select the desired attribute from the dropdown menu.
- 8.Type the value for your IDP's attribute.
- 9.Select Save changes.
- 10.Repeat for each custom attribute as needed. You do not need to add the default mappings — only add attributes that differ from the defaults.
These changes take effect immediately. If your SAML configuration is in active use with verified domains, the new attributes will have an immediate impact.
Summary Checklist
- Configure the Entity ID, ACS URL, and SP metadata URL in your IDP.
- Include middle_name if possible — it helps users pass KBA when signing documents.
- Include notary_state and notary_languages if any users have the notary role.
- If your IDP uses non-default attribute names, configure custom attribute mapping in Command Center → Security → Identity providers.
- Shared mailboxes: SSO users cannot access transactions via shared inbox invitation links — they must log in through their organization's SSO flow directly.
If you are still unsure, contact Proof Support for help.
Related
Command Center
Command Center is an enterprise administration tool that enables organizations to centrally manage Proof across divisions with advanced user provisioning, precise permission controls, team-based data organization, automated user management via SCIM, and robust security features including SSO, just-in-time provisioning, sign-up restrictions, email change controls, and rigorous data protection to ensure compliance and secure customer data.
Brand Customization Overview – Proof Help Center
Organizations with a Premium or higher Proof account can customize branding elements such as logo, colors, and landing pages visible to customers completing transactions via Proof links or invitations, while certain elements like email wording and signer page layout remain unchangeable, and multi-organization brand management is facilitated through Command Center.
Proof Business Pro
Proof Business Pro is a comprehensive, pay-per-transaction platform offering online notarization starting at $25 per meeting, identity verification from $4 per person, and eSignature services at $4 per transaction, designed to streamline business operations with automated transaction management, robust security, and flexible workflows that enhance efficiency, reduce errors, and provide seamless, secure customer interactions anytime, anywhere.
Company Structure: Parent and Child Organizations – Proof Help Center
The Proof company structure organizes multiple organizations into a hierarchy with root, parent, and child organizations—where parent organizations can manage settings and access data of their child organizations, users have a home organization determining their access, and certain settings like logos and configurations can be inherited from parent to child, with a maximum hierarchy depth of four levels and management facilitated via Command Center.
Fast, Secure Online Closings for Title Professionals
Proof Title Pro offers title professionals a secure, efficient platform for managing home closings with eClosing and online notarization tools, featuring pay-per-transaction pricing, built-in fraud protection through multi-factor identity verification, and support for hybrid and fully digital closings to streamline processes and enhance client experience.
User Roles in Command Center
In Command Center, the Owner has full unrestricted access including transferring ownership, Admins have full access except ownership transfer and can manage users and transactions, while User Managers (Enterprise only) can only view and manage users without access to transaction data or promoting users.