Enable Enterprise SAML Single Sign On

Reid Tattersall

5/17/2024 · 3 min read

About identity and access management with SAML single sign-on

SAML single sign-on (SSO) gives organization and enterprise owners using BOSS a way to control and secure access to organization resources.

About SAML SSO

When you attempt to sign in to BOSS, BOSS redirects you to your organization’s SAML identity provider (IdP). After you authenticate, the IdP redirects you back to BOSS, where you can access your organization’s resources.

Getting started

SAML SSO requires a one-time setup fee of $3,000.

BackNine’s SAML endpoints are:

  • Assertion Consumer Service URL: https://app.back9ins.com/auth/saml/auth
  • Service Provider Entity ID: https://app.back9ins.com/auth/saml/metadata

To get started, email the following SAML metadata to eng@back9ins.com:

  • IdP SLO Service URL
  • IdP SSO Service URL
  • IdP Entity ID
  • X.509 certificate

SAML attributes

BOSS uses the SAML response to identify the user signing in. At a minimum, the response must include values mapped to:

  • saml_id: A stable, unique identifier for the user.
  • email: The user’s email address.

Optional mapped values:

  • admin: Grants full BOSS access to the organization’s connected agents and agencies. Map either admin=true or a role containing admin to this value.
  • agent_npn: The agent’s National Producer Number.
  • agent_first_name: The agent’s first name.
  • agent_last_name: The agent’s last name.
  • agent_email: The agent’s email address. Defaults to the SSO user’s email when omitted.
  • agency_npn: The associated agency’s National Producer Number.
  • producer_code: The agent’s identifier within the IdP’s producer hierarchy. This value is used only during first-time SAML provisioning.
  • parent_producer_code: The identifier for the agent’s parent producer. This value is used only during first-time SAML provisioning.

When producer_code and parent_producer_code are both present and equal, BOSS treats the user as the principal signer for the agency identified by agency_npn. If that agency does not exist, BOSS creates it and connects the new agent as its signer.

When the values are different or omitted, the agency identified by agency_npn must already exist. Otherwise, sign-up stops and asks the agency principal to create an account first.

These codes are used only to determine signer status during initial account creation. They are not saved on the agent or agency.

Optional values are not required for standard SSO and may require additional setup by BackNine.

Admin access does not subscribe the user to email notifications for the organization’s connections.

Sending admin access

You can grant admin access by sending an admin attribute with a value of true:

<saml:Attribute Name="admin">
  <saml:AttributeValue
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:type="xs:boolean">true</saml:AttributeValue>
</saml:Attribute>

You can also send a role with a value of admin:

<saml:Attribute Name="role">
  <saml:AttributeValue>admin</saml:AttributeValue>
</saml:Attribute>

Role values are case-insensitive, and multi-valued role attributes are supported. Values other than admin do not grant admin access.

Microsoft Entra commonly sends application roles using this claim name:

http://schemas.microsoft.com/ws/2008/06/identity/claims/role

When using Microsoft Entra application roles:

  1. Define an application role with the value admin.
  2. Assign the appropriate users or groups to that role.
  3. Include the emitted role claim name and an example SAML response when contacting BackNine.

If your IdP uses custom claim names, BackNine will map those claims to the corresponding BOSS values.

Include the desired claim names and example values when emailing eng@back9ins.com.

SSO login experience

The sign-in page is the same for SSO and non-SSO users:

https://app.back9ins.com/sign-in

  1. Enter your email address.
  2. If the email domain belongs to an organization configured for SSO, BOSS redirects you to its identity provider, such as Microsoft Entra, Google, or Okta.
  3. If SSO is not configured for the domain, BOSS displays the password field.
  4. New and existing SSO users can use the same sign-in page. New users may be asked a few questions before accessing their account.
© 2026