Redash SAML Integration

This document explains how to implement Monosign with Redash, the open-source query and dashboard tool. It covers Single Sign-On using SAML 2.0, where Monosign acts as the Identity Provider (IdP) and Redash as the Service Provider (SP). Before you continue, it is better to start with the Redash documentation.

This configuration is done with the self-hosted Redash 26.9.0 container image (redash/redash:26.9.0), set up with the official Docker Compose files of Redash. If your Redash version or deployment type is different, please check the Redash documentation.

Redash has a built-in SAML 2.0 login. It does not have a generic OAuth 2.0 / OpenID Connect login (only Google OAuth), so this integration uses SAML.

Monofor has no responsibility to do Redash configurations. If you need support please contact the Redash community or your Redash support provider.

📑 Instructions

This documentation contains 5 main steps for integration.

Creating an application on Monosign
Configuring the SAML settings on Monosign
Assign a user to the Redash application
Configuration Single Sign-On for Redash
Sign In Test

1- Creating an Application on Monosign

Create your application on Monosign first. Open the Applications page from the left menu and click Add New.

Applications page in Monosign (1: Applications menu, 2: Add New)

Redash is not in the application catalog, so click Create from scratch.

Creating a new application from scratch (1: Create from scratch)

Fill in the application details on the Application tab and click Next.

New Application - Application tab (1: Name, 2: Logo, 3: Next)

Property	Value	Description
Name	`Redash`	Name of the application shown to users on the Monosign portal and on the Monosign sign-in page.
Type	`Web`	Redash is accessed through a web browser. Options: Web, Mobile, Desktop, API.
Url	Optional	Leave empty or enter the Redash address (for example `https://redash.example.com`).
Logo	`redash.jpg`	Optional. Browse and upload a logo; it is also shown on the Monosign sign-in page.
Users can see this application on their list	`Enabled`	Displays the application on the user portal.

On the Access tab define who can reach the application and click Create Application.

New Application - Access tab (1: Profile Access Type, 2: Create Application)

Property	Value	Description
User Access Type	`System Default`	Defines which users can access this application. Options: Only Assigned Users, All Users, System Default.
User Group Access Type	`System Default`	Defines the application’s user group access.
Source Using Type	`System Default`	Defines which user sources the application can use.
Profile Access Type	`All`	Defines which user profile attributes are available to the application. Redash needs the first name and the last name of the user, so the profile must be accessible (Options: Restricted, All).

After the application is created, click Keys and add a new Access Key for SAML access.

Keys tab of the Redash application (1: Keys, 2: Add New Access Key)

Select SAML as the key type and click Create. Monosign generates the Key value of the SAML application automatically; it is a part of the Monosign SAML addresses.

Creating the SAML Access Key (1: Type SAML, 2: Create)

Property	Value	Options
Type	`SAML`	Rest API, OAuth 2.0, JWT, OIDC/OpenID, SAML, RADIUS, Access Gateway, LDAP, AuthN/Z Server
Key	Generated automatically	Unique identifier of the SAML application in the Monosign addresses.
Session	`System Default`	System Default, On-demand, Permanent
State	`Enabled`	Enabled, Disabled
Never Expires	`Yes`	Turn off to define a specific expiration date for the key.

2- Configuring the SAML Settings on Monosign

Open the Edit screen of the SAML key and go to the SAML Settings → Configuration tab. Enter the address where Redash receives the SAML response in Assertion Consumer Url.

SAML Settings - Configuration tab (1: SAML Settings, 2: Assertion Consumer Url)

Then set the NameId Format and the Name Id.

Property	Value	Description
Assertion Consumer Url	`https://redash.example.com/saml/callback?org_slug=default`	The ACS address of Redash. Use the public (HTTPS) address of Redash exactly as shown; `org_slug=default` is the default organization of Redash.
ACS Validation Mode	`Enforce`	Monosign accepts only the registered ACS address.
Audience / Entity Id / Idp Description	Empty	Not required for Redash.
NameId Format	`urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`	The user is identified by e-mail address.
Name Id	`Email`	Redash reads the e-mail address of the user from the NameID of the SAML response, so it must be the e-mail.

Open the Attribute Mapping tab and add the first name and the last name of the user. Click Update to save.

Attribute	Value	Description
FirstName	`{{Profile.FirstName}}`	First name of the user. Required by Redash.
LastName	`{{Profile.LastName}}`	Last name of the user. Required by Redash.
RedashGroups	Optional	Names of the Redash groups of the user. If it is sent, Redash assigns the user to these groups at every login.

The attribute names are case sensitive and Redash reads exactly FirstName and LastName. If one of them is missing in the SAML response, Redash cannot create the user and answers with 500 Internal Server Error. Make sure that the Monosign users who sign in to Redash have their first name and last name filled in their profile.

The Monosign values that are needed in the Redash configuration (step 4) are on the key page:

Monosign value	Example	Used in Redash as
Sign On Service	`https://<monosign-host>/saml/<key>/login`	SAML Single Sign-on URL
Entity Id of the IdP (in the IdP metadata)	`https://<monosign-host>/saml/<key>`	SAML Entity ID
View Certificate / Download Certificate	X.509 certificate of Monosign	SAML x509 cert
Metadata, Download IdP Metadata	`https://<monosign-host>/saml/<key>/metadata`	SAML Metadata URL (only for the Dynamic mode)

3- Assign a User to the Redash Application

Please follow the below instructions on how to assign a user to the Redash application. Open the application, click the Assignments tab and click Assign a User.

Assignments tab of the Redash application (1: Assignments, 2: Assign a User)

Search and select the users who can sign in to Redash, check the Expiration Date and save. You can select more than one user.

Assign a User dialog (select the users and set the Expiration Date)

Property	Value	Description
User(s)	Selected users	Users who can sign in to Redash with Monosign.
Expiration Date	Default one year	The assignment expires on this date.

4- Configuration Single Sign-On for Redash

As we mentioned at the start, please check out the Redash documentation first. The SAML settings of Redash are made in the Redash web interface by an administrator. A new Redash installation first asks you to create the administrator account on the /setup page. After that the Welcome to Redash page opens.

Click Settings, open the General tab and scroll down to the Authentication section.

Redash Settings - General - Authentication (1: General, 2: Authentication, 3: Enabled (Static))

Under SAML select Enabled (Static), enter the Monosign values from step 2 and click Save.

Property	Value	Description
SAML Enabled	`Enabled (Static)`	The Monosign values are entered by hand. Options: Disabled, Enabled (Static), Enabled (Dynamic).
SAML Single Sign-on URL	`https://<monosign-host>/saml/<key>/login`	Sign On Service of the Monosign SAML key.
SAML Entity ID	`https://<monosign-host>/saml/<key>`	Entity Id of the Monosign IdP.
SAML x509 cert	`MIIDpTCC…`	The Monosign certificate as a single line, without the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines.

Paste only the base64 text of the certificate. Redash puts this value into the SAML metadata as it is. If the BEGIN/END CERTIFICATE lines are included, the certificate becomes invalid, Redash cannot verify the signature of the SAML response and the sign-in fails with “SAML login failed. Please try again later.”. The Redash log shows Failed to verify signature in this case.

Keep Password Login Enabled checked until you have tested the SAML sign-in, so the administrator can still log in with the e-mail address and password.

Instead of the Static mode you can select Enabled (Dynamic) and enter the Monosign SAML Metadata URL, the SAML Entity ID and the SAML NameID Format. Redash users are created automatically on their first SAML sign-in and they are added to the default group of Redash.

Now try to log in to Redash using Monosign SSO.

Open a new browser window (or a private window) and type the Redash address, for example https://redash.example.com.
Click SAML Login on the Redash login page. The e-mail and password form stays on the page for the administrator.

Redash login page with the SAML Login button

Redash redirects the browser to the Monosign sign-in page of the Redash application. You can log in passwordless with your QR code (Monofor Identity), with a Passkey or with your user name and password (Sign in with Password).

Monosign sign-in page of the Redash application

After the sign-in Monosign sends the SAML response to Redash. Redash creates the user on the first sign-in with the name and the e-mail address from Monosign and the user is logged in.

User logged in to Redash through Monosign SSO (Settings - Account: name, e-mail and the default group)

Troubleshooting

Symptom	Cause	Solution
“SAML login failed. Please try again later.” on the Redash login page; the Redash log shows `Failed to verify signature`	The SAML x509 cert is wrong, or it contains the BEGIN/END CERTIFICATE lines.	Paste only the base64 text of the current Monosign certificate as one line (step 4).
500 Internal Server Error on `/saml/callback`; the Redash log shows `KeyError: 'FirstName'` (or `'LastName'`)	The attribute is not in the SAML response.	Add `FirstName` and `LastName` in the Attribute Mapping of the Monosign SAML key (step 2) and fill in the first name and last name of the user profile.
The user is created with a wrong e-mail address	Name Id is not the e-mail address.	Set Name Id to `Email` and NameId Format to `emailAddress` (step 2).
Monosign rejects the request because of the ACS address	ACS Validation Mode is Enforce and the ACS address of Redash is not the registered one.	The Assertion Consumer Url must be exactly `https://redash.example.com/saml/callback?org_slug=default`.
A user cannot sign in	The user is not assigned to the application.	Assign the user in step 3.
A new user can only see a few Redash pages	The user is added only to the default group.	Give the user more permissions in Redash (Settings → Users and Groups) or send the `RedashGroups` attribute from Monosign.
OAuth 2.0 / OpenID Connect sign-in is required	Redash has only the Google OAuth, no generic OAuth/OIDC login.	Use the SAML integration in this document.

After completing the configuration on Redash and Monosign, it is better to test in a new private browser window if the SAML SSO doesn’t work, because old session cookies of the Redash address may cause errors.