SAML single sign on (SSO) offers you increased control over how users access Calendly. With SAML SSO, you can require that users log in to Calendly with their OneLogin credentials.
Note
If you are on our Teams plan and would like to add single sign-on (SSO) features to your Calendly account, please contact our Sales team and they would be happy to assist you. The SSO add-on costs $3 per user, per month.
SAML SSO is included on the Enterprise plan. To learn more about Enterprise, contact your Account Executive or Calendly Sales.
Supported features
-
Service Provider Initiated SSO (SP-initiated) : Users can log in to calendly.com, and OneLogin will authenticate the user.
- Identity Provider Initiated SSO (IdP-initiated): Users can log in to OneLogin and select the Calendly app.
Non-supported features
- Just-in-Time (JIT) provisioning is not supported. You can provision users via SCIM.
Before you begin…
-
To configure SSO, you must be a Calendly owner or admin.
-
You must use the same email address in Calendly and OneLogin.
-
In OneLogin, you need admin access to create a SAML application.
- For easier setup, use separate browser windows: one for Calendly and one for OneLogin.
1. Navigate to the Calendly SSO Configuration Page
- In Calendly, go to Account, Organization Settings, then Single sign-on.
2. Add Calendly as an application in OneLogin
-
Open OneLogin in a separate browser window.
-
In OneLogin, go to Applications, then Applications.
-
Select Add App.
-
Search for Calendly, and select the result with the SAML 2.0 provisioning label.
-
Select save.
3. Configure in OneLogin
-
In OneLogin, select Configuration in the lefthand sidebar.
-
In the SCIM Base URL field, enter "https://api.calendly.com". You’ll change this value later. This temporary value is necessary to prevent an error when configuring SSO.
-
Select Save.
4. Add identity provider details to Calendly
-
In OneLogin, select SSO in the lefthand sidebar. You’re going to copy values from the SSO section and add them to Calendly, under Step 1: Enter your identity provider information.
-
In OneLogin, copy the Issuer URL by selecting the Copy to Clipboard icon. In Calendly, paste the value in Entity ID.
-
In OneLogin, copy the SAML 2.0 Endpoint (HTTP), by selecting the Copy to Clipboard icon. In Calendly, paste the value in Identity provider’s SAML HTTP Request URL.
-
In OneLogin, under X.509 Certificate, right click View Details and select Open link in new tab.
-
In OneLogin, select Copy to Clipboard to copy the X.509 Certificate value into X.509 certificate for SAML authentication in Calendly. Note: You can include -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- in your selection.
-
Close the OneLogin certificate tab, and return to the OneLogin SSO tab.
-
In OneLogin, change the SAML Signature Algorithm from SHA-1 to SHA-256. Select Save.
-
In Calendly, select your preferred Session Duration.
-
Select Save & continue.
| OneLogin value | Calendly field |
| Issuer URL | Entity ID |
| SAML 2.0 Endpoint (HTTP) | Identity provider's SAML HTTP Request URL |
| X.509 certificate (in view details) | X.509 certificate for SAML authentication |
5. Add details to OneLogin
-
In OneLogin, select Configuration in the lefthand sidebar.
-
In Calendly, select Copy Audience URL, and paste the value in OneLogin in SAML Audience URL.
-
In Calendly, select Copy ACS URL, and paste the value in OneLogin in SAML Consumer URL.
-
In Calendly, select Default Relay State, and paste the value in OneLogin in RelayState.
-
Select Save.
| Calendly value | OneLogin field |
| Audience URL | SAML Audience URL |
| ACS URL | SAML Consumer URL |
6. Add parameters in OneLogin
-
In OneLogin, select Parameters in the lefthand sidebar.
-
Select the SAML NameID (Subject) row.
-
Set Value to Email.
-
Select save.
7. Assign the Calendly app to a test user
-
In OneLogin, select Users.
-
Select the user with an email that matches the Calendly account you’re logged into.
-
Select Applications on the left.
-
Select the + button and select Calendly.
-
Select Continue.
8. Test the connection
In Calendly, select Test Connection. If successful, you’ll see a confirmation message, and can proceed to enforce SAML SSO for all members. If unsuccessful, you’ll see an error page on Okta or receive an error notification in Calendly.
9. Enforce SSO for your organization
-
In OneLogin, assign Calendly to all users. Make sure users have matching email addresses for Calendly and OneLogin.
-
In Calendly, select Enforce SAML SSO for my organization.
When you enforce SAML SSO, all users are logged out of their accounts. When they next sign in to Calendly, they will be required to use SSO to log in.
Note: the organization owner can choose to log in using their original login method, by selecting Log in using another method on the login page.