This document explains how to implement Monosign with Mautic, an open source marketing automation platform. It covers Single Sign-On using SAML 2.0, where Monosign acts as the Identity Provider (IdP) and Mautic as the Service Provider (SP). Before you continue, it is better to read the Mautic documentation (opens in a new tab) about the SAML single sign-on.
This configuration was tested with Mautic 7.2.2. If your version is different, please check the Mautic documentation.
SAML is configured in the Mautic interface under Settings → Configuration → User/Authentication Settings, in the section SAML SSO Settings. OpenID Connect is not available in the released versions of Mautic.
Monofor has no responsibility to do Mautic configurations. If you need support please contact the Mautic community or your Mautic support provider.
Instructions
This documentation contains 5 main steps for integration.
Creating an application on Monosign
Configuring the SAML settings on Monosign
Assign a user to the Mautic application
Configuration Single Sign-On for Mautic
Sign In Test
1- Creating an Application on Monosign
Create your application on Monosign first. Open the Applications page from the left menu and click Add New.
Mautic is not in the application catalog, so click Create from scratch.
Fill in the application details on the Application tab and click Next.
Property | Value | Description |
|---|---|---|
Name |
| Name of the application shown to users on the Monosign portal and on the Monosign sign-in page. |
Type |
| Mautic is accessed through a web browser. Options: Web, Mobile, Desktop, API. |
Url | Optional | Leave empty or enter the address of Mautic (for example |
Logo | Optional | Browse and upload a logo; it is also shown on the Monosign sign-in page. |
Users can see this application on their list |
| Displays the application on the user portal. |
On the Access tab define who can reach the application and click Create Application.
Property | Value | Description |
|---|---|---|
User Access Type |
| Defines which users can access this application. Options: Only Assigned Users, All Users, System Default. |
User Group Access Type |
| Defines the application’s user group access. |
Source Using Type |
| Defines which user sources the application can use. |
Profile Access Type |
| Defines which user profile attributes are available to the application (Options: Restricted, All). Mautic needs the e-mail address, the user name and the first and last name of the user. |
After the application is created, click Keys and add a new Access Key for SAML access.
Select SAML as the key type and click Create. Monosign generates the Key value of the SAML application automatically; it is a part of the Monosign SAML addresses.
Property | Value | Options |
|---|---|---|
Type |
| Rest API, OIDC/OpenID, SAML, RADIUS, Access Gateway, LDAP, AuthN/Z Server |
Key | Generated automatically | Unique identifier of the SAML application in the Monosign addresses. |
Session |
| System Default, On-demand, Permanent |
State |
| Enabled, Disabled |
Never Expires |
| Turn off to define a specific expiration date for the key. |
The key page shows the Monosign values that are needed in the Mautic configuration (step 4):
Monosign value | Example | Used in Mautic as |
|---|---|---|
Metadata (View IdP Metadata / Download IdP Metadata) |
| Identity provider metadata file. Use Download IdP Metadata and upload the XML file to Mautic; Mautic reads the Sign On Service, the Entity Id and the certificate of Monosign from it, so they are not entered one by one. |
Sign On Service |
| Read by Mautic from the metadata. |
Entity Id |
| Read by Mautic from the metadata. |
View Certificate / Download Certificate | X.509 certificate of Monosign | Also read from the metadata. |
2- Configuring the SAML Settings on Monosign
Click the Configure button of the SAML key (or Edit of the key) and go to the SAML Settings → Configuration tab. Enter the address where Mautic receives the SAML response in Assertion Consumer Url.
Property | Value | Description |
|---|---|---|
Assertion Consumer Url |
| The address where Mautic receives the SAML response (HTTP-POST binding). The path starts with |
ACS Validation Mode |
| Monosign accepts only the registered ACS address. |
Audience and Entity Id | Empty | Not required. To restrict the response to Mautic, enter the Entity Id of Mautic (its site address without a slash at the end, as shown in the SP metadata). |
NameId Format |
| Default value. |
Name Id |
| Mautic uses the attribute values below, not the NameID, to identify the user. |
Open the Attribute Mapping tab, add the attributes that Mautic reads and click Update to save.
Attribute | Value | Description |
|---|---|---|
EmailAddress |
| Required. E-mail address of the user; Mautic uses it as the identity of the user. |
username |
| Optional. User name of the Mautic account. If it is empty, the e-mail address is used. |
FirstName |
| First name of the Mautic account. |
LastName |
| Last name of the Mautic account. |
The attribute names are written in the Mautic settings (step 4); the names in Monosign and in Mautic must be exactly the same, including the case.
3- Assign a User to the Mautic Application
Open the application in Monosign, click the Assignments tab and click Assign a User.
Search and select the users who can sign in to Mautic, check the Expiration Date and save. You can select more than one user.
4- Configuration Single Sign-On for Mautic
As we mentioned at the start, please check out the Mautic documentation first. Log in to Mautic with an administrator account, open Settings → Configuration → User/Authentication Settings, go to the section SAML SSO Settings, fill in the fields below and click Save & Close.
Field | Value | Description |
|---|---|---|
Entity ID for the IDP |
| Entity Id of Mautic that is sent to the identity provider. Select the site address of Mautic from the list. |
Identity provider metadata file | Monosign metadata XML file | Click Choose File and select the metadata file downloaded from the Monosign key page (step 1). |
Default role for created users | A Mautic role | Role given to the users that are created at the first sign-in. Leave it empty to disable the creation of users; then only existing Mautic users with the same e-mail address can sign in. |
| Name of the attribute of step 2. | |
Username (optional) |
| Name of the attribute of step 2. |
First name |
| Name of the attribute of step 2. |
Last name |
| Name of the attribute of step 2. |
X.509 certificate, Private key and Private key encryption password | Optional | Only needed to use your own certificate to secure the communication between Mautic and the identity provider. Upload the certificate and its private key together; enter the password only if the key is encrypted. |
Every user that is created automatically gets the default role. Do not choose a role with administrator permissions unless every user assigned to the application should be an administrator.
The Entity ID list contains the Site URL of Mautic (Settings → Configuration → System Settings). Make sure it is the public HTTPS address. When Mautic is behind a reverse proxy, the proxy must send the header X-Forwarded-Proto: https and Mautic must trust the proxy (the trusted_proxies setting), otherwise the addresses in the SAML messages start with http://.
5- Sign In Test
Now try to log in to Mautic using Monosign SSO. Open a new browser window (or a private window) and type the address of Mautic. When SAML is configured, Mautic redirects the browser to the Monosign sign-in page of the application.
On the Monosign sign-in page log in passwordless with your QR code (Monofor Identity), with a Passkey or with your user name and password (Sign in with Password). If you are already signed in to Monosign, the page is skipped.
After the sign-in Monosign sends the SAML response to the ACS address of Mautic (
/s/saml/login_check). At the first sign-in Mautic creates the user with the name and the e-mail address from Monosign and opens the dashboard.
The local sign-in form of Mautic is still available at https://<mautic-address>/s/login.
Troubleshooting
Symptom | Cause | Solution |
|---|---|---|
The page 404 appears after the sign-in on Monosign | The Assertion Consumer Url in Monosign is | Use exactly |
Mautic does not redirect to Monosign | The SAML settings are not saved or the metadata of Monosign was not loaded. | Check step 4 and save the settings again. |
Monosign shows an error about the ACS address | The Assertion Consumer Url of Monosign is different from the ACS address of Mautic, for example because it starts with | Compare it with the address in |
The sign-in fails after returning from Monosign | The attribute names are different in Monosign and Mautic, or the Audience does not match the Entity ID of Mautic. | Compare the attribute names of step 2 with step 4. Leave the Audience empty or use the Entity Id of Mautic. |
The sign-in succeeds on Monosign but Mautic refuses the user | No Mautic user has the e-mail address of the Monosign user and no default role is selected. | Select the default role in step 4 or create the Mautic user with the same e-mail address. |
The sign-in fails with an error about the time of the response | The clocks of Mautic and Monosign are different. | Synchronize the clocks of both servers. |
A user cannot sign in | The user is not assigned to the application. | Assign the user in step 3. |
After completing the configuration on Mautic and Monosign, it is better to test in a new private browser window if the SAML SSO doesn’t work, because old session cookies may cause errors.