This document explains how to implement Monosign with Metabase, the open-source business intelligence and analytics application. It covers Single Sign-On using SAML 2.0, where Monosign acts as the Identity Provider (IdP) and Metabase as the Service Provider (SP). Before you continue, it is better to read the Metabase SAML documentation.
This configuration is done with Metabase Enterprise v1.64.3.2 (image metabase/metabase-enterprise:v1.64.3.2 with a PostgreSQL application database). The same SAML settings apply to Metabase Cloud. If your Metabase version or deployment type is different, please check the Metabase documentation.
SAML is configured in the Metabase admin interface (Admin → Settings → Authentication → SAML). Metabase matches and creates users by their e-mail address.
License. SAML single sign-on in Metabase is an Enterprise / Pro feature. The open-source edition has only Google and LDAP authentication and no generic OIDC. The enterprise Docker image runs with open-source features until a license token is activated, so a token is required for SAML. A self-service trial token is available at store.metabase.com/checkout (self-hosted, no sales call); activate it under Admin → Settings → License.
Monofor has no responsibility to do Metabase configurations. If you need support please contact Metabase or your Metabase support provider.
📑 Instructions
This documentation contains 5 main steps for integration.
-
Creating an application on Monosign
-
Configuring the SAML settings on Monosign
-
Assign a user to the Metabase application
-
Configuration Single Sign-On for Metabase
-
Sign In Test
1- Creating an Application on Monosign
Create your application on Monosign first. Open the Applications page from the left menu and click Add New.
Metabase is not in the application catalog, so click Create from scratch.
Fill in the application details on the Application tab and click Next.
|
Property |
Value |
Description |
|---|---|---|
|
Name |
|
Name of the application shown to users on the Monosign portal and on the Monosign sign-in page. |
|
Type |
|
Metabase is accessed through a web browser. Options: Web, Mobile, Desktop, API. |
|
Url |
Optional |
Leave empty or enter the Metabase address (for example |
|
Logo |
Optional |
Browse and upload a logo; it is also shown on the Monosign sign-in page. |
|
Users can see this application on their list |
|
Displays the application on the user portal. |
On the Access tab define who can reach the application and click Create Application.
|
Property |
Value |
Description |
|---|---|---|
|
User Access Type |
|
Defines which users can access this application. Options: Only Assigned Users, All Users, System Default. Metabase creates an account for every user who signs in, so give access only to the users you assign in step 3. |
|
User Group Access Type |
|
Defines the application’s user group access. |
|
Source Using Type |
|
Defines which user sources the application can use. |
|
Profile Access Type |
|
Defines which user profile attributes are available to the application (Options: Restricted, All). Metabase needs the e-mail address, first name and last name of the user, so the profile must be accessible. |
Metabase creates an account for every Monosign user who signs in for the first time (just-in-time provisioning). Make sure the User Access Type is Only Assigned Users and give access only to the users you assign in step 3.
After the application is created, click Keys and add a new Access Key for SAML access.
Select SAML as the key type and click Create. Monosign generates the Key value of the SAML application automatically; it is a part of the Monosign SAML addresses.
|
Property |
Value |
Options |
|---|---|---|
|
Type |
|
Rest API, OAuth 2.0, JWT, OIDC/OpenID, SAML, RADIUS, Access Gateway, LDAP, AuthN/Z Server |
|
Key |
Generated automatically |
Unique identifier of the SAML application in the Monosign addresses. |
|
Session |
|
System Default, On-demand, Permanent |
|
State |
|
Enabled, Disabled |
|
Never Expires |
|
Turn off to define a specific expiration date for the key. |
The key page shows the Monosign values that are needed in the Metabase SAML configuration (step 4):
|
Monosign value |
Example |
Used in Metabase as |
|---|---|---|
|
Sign On Service |
|
SAML Identity Provider URL |
|
Entity Id |
|
SAML Identity Provider Issuer |
|
View Certificate / Download Certificate |
X.509 certificate of Monosign |
SAML Identity Provider Certificate |
|
Metadata, Download IdP Metadata |
|
Not required by Metabase; the three values above are entered by hand. |
2- Configuring the SAML Settings on Monosign
Open the Edit screen of the SAML key and go to the SAML Settings → Configuration tab. Enter the address where Metabase receives the SAML response in Assertion Consumer Url (the Metabase ACS URL, step 4). The other fields stay at their defaults.
|
Property |
Value |
Description |
|---|---|---|
|
Assertion Consumer Url |
|
The address where Metabase receives the SAML response. Metabase shows this value on the SAML page; it is built from the Metabase Site URL (step 4). |
|
ACS Validation Mode |
|
Recommended. Monosign only accepts the registered ACS address, so the Assertion Consumer Url above must exactly match the Metabase ACS URL. Use |
|
Audience / Entity Id / Idp Description |
Empty |
Not required for Metabase. |
|
NameId Format |
|
Default value. |
|
Name Id |
|
The SAML subject (NameID). Metabase identifies the user by the email attribute (Attribute Mapping below), so the NameID is not used for matching; here it is the user name. |
Open the Attribute Mapping tab, add the e-mail, first name and last name attributes and click Update to save. The attribute names used here are the default attribute names of Metabase and must be the same as the attribute names in Metabase (step 4).
|
Attribute |
Value |
Description |
|---|---|---|
|
|
|
E-mail address of the user. This is the default email attribute name of Metabase; use the same name in the Metabase email attribute field (step 4). |
|
|
|
First name of the user. Default first name attribute name of Metabase. |
|
|
|
Last name of the user. Default last name attribute name of Metabase. |
The attribute names are the default attribute names Metabase uses (the schemas.xmlsoap.org URNs). The same names must be used on both sides — the Monosign Attribute Mapping (this step) and the Metabase attribute fields (step 4). The {{...}} value templates read the fields from the Monosign user profile; you can use UserName, FormattedUserName, UserId, Email, Culture and profile properties.
3- Assign a User to the Metabase Application
Please follow the below instructions on how to assign a user to the application. Open the application, click the Assignments tab and click Assign a User.
Search and select the users who can sign in to Metabase, check the Expiration Date and save. You can select more than one user.
|
Property |
Value |
Description |
|---|---|---|
|
User(s) |
Selected users |
Users who can sign in to Metabase with Monosign. |
|
Expiration Date |
Default one year |
The assignment expires on this date. |
4- Configuration Single Sign-On for Metabase
As we mentioned at the start, please check out the Metabase documentation first. SAML is an Enterprise / Pro feature, so a license token must be active before the SAML settings appear. Paste the token under Admin → Settings → License and click Activate. Then open Admin → Settings → Authentication → SAML and click Set up.
At the top of the SAML page Metabase shows the address it expects the SAML response at — the Assertion Consumer Service (ACS) URL, https://<metabase-host>/auth/sso. Copy it into the Assertion Consumer Url of Monosign (step 2). This address is built from the Metabase Site URL, so the Site URL must be the public HTTPS address of Metabase.
|
Metabase field |
Value |
Description |
|---|---|---|
|
SAML Identity Provider URL |
|
The Sign On Service of the Monosign SAML key (step 1). |
|
SAML Identity Provider Certificate |
|
The Monosign X.509 certificate (View Certificate or Download Certificate on the key page). Paste the whole PEM block. |
|
SAML application name |
|
Free label used for the SAML requests to the IdP. |
|
SAML Identity Provider Issuer |
|
The Entity Id of the Monosign SAML key (step 1). |
|
User’s email attribute |
|
Must match the Monosign Attribute Mapping (step 2). This is the Metabase default. |
|
User’s first name attribute |
|
Must match the Monosign Attribute Mapping (step 2). Metabase default. |
|
User’s last name attribute |
|
Must match the Monosign Attribute Mapping (step 2). Metabase default. |
Save the settings and make sure SAML authentication is enabled.
Metabase creates the user on the first SAML sign-in (just-in-time provisioning) and matches an existing user by e-mail address. Mapping Monosign groups to Metabase groups is optional and is done with the Synchronize group memberships option and a group attribute; it is not required for sign-in.
Keep an administrator account that can still sign in with e-mail and password, and do not close your own session before the sign-in test is successful. If the single sign-on fails, you can still sign in at https://<metabase-host>/auth/login with the local password.
5- Sign In Test
Now try to log in to Metabase using Monosign SSO.
-
Open a new browser window (or a private window) and type the Metabase address, for example
https://<metabase-host>. The login page shows the Sign in with SSO button and, below it, the Sign in with email link for the local password login. -
Click Sign in with SSO. Metabase redirects the browser to the Monosign sign-in page of the application. You can log in passwordless with your QR code (Monofor Identity), with a Passkey or with your user name and password (Sign in with Password). If you are already signed in to Monosign, the page is skipped.
-
After the sign-in Monosign sends the SAML response to the ACS URL of Metabase and the user is logged in to Metabase.
Troubleshooting
|
Symptom |
Cause |
Solution |
|---|---|---|
|
The SAML settings or the Sign in with SSO button are not shown |
The Enterprise / Pro license is not active, or SAML authentication is not enabled. |
Activate the license token (Admin → Settings → License) and enable SAML (step 4). |
|
Monosign shows an error about the ACS address |
The Assertion Consumer Url of Monosign is different from the ACS URL of Metabase. With ACS Validation Mode = Enforce the two must match exactly. |
Copy |
|
The sign-in succeeds on Monosign but Metabase does not log the user in |
The certificate or the issuer is wrong, or the e-mail / name attributes are missing or named differently. |
Copy the issuer and the certificate again from the Monosign key page (step 1) and check that the attribute names match on both sides (steps 2 and 4). |
|
The redirect address is wrong or uses http instead of https |
The Metabase Site URL is wrong, or the reverse proxy does not send |
Set the Metabase Site URL to the public HTTPS address and make the reverse proxy forward |
|
A user cannot sign in |
The user is not assigned to the application. |
Assign the user in step 3. |
|
The single sign-on does not work and you cannot enter Metabase |
A wrong value was saved in the SAML settings. |
Sign in at |
After completing the configuration on Metabase and Monosign, it is better to test in a new private browser window if the SAML SSO doesn’t work, because old session cookies may cause errors.