How to Set Up SSO for mobiQode: Google Workspace, Microsoft Entra ID & Okta
Single Sign-On sounds like it should be complicated — certificates, metadata, SAML assertions. In practice, setting it up for mobiQode is a matter of copying a handful of values in the right direction, twice. This guide walks through exactly that, for whichever identity provider your organization runs: Google Workspace, Microsoft Entra ID, or Okta.
mobiQode’s SSO is built on SAML 2.0. In SAML terms, mobiQode is the Service Provider (SP) — the app your team signs into — and Google Workspace, Microsoft Entra, or Okta is the Identity Provider (IdP) — the system that actually authenticates the user. The two sides need to trust each other, which is what this whole setup process is about.
Before You Start
- Organization Owner or Admin access in mobiQode
- Administrator access to your identity provider (Google Workspace, Microsoft Entra, or Okta) with permission to create a SAML application
- A production HTTPS domain for mobiQode SSO
- A test user who exists in both systems, using the exact same email address in each
- That test user enabled/assigned to the new application in your identity provider
Step 1: Configure mobiQode as the Service Provider
This part is identical no matter which identity provider you’re connecting.
1 Log in to mobiQode as an Organization Owner or Admin and go to Organization → Team Users → SSO Configuration.
2 Select your Identity Provider, enter your Company name, and set the Slug (the lowercase organization identifier used in your SP URLs).
3 Copy the two values mobiQode generates for you — you’ll paste these into your identity provider in the next step:
| mobiQode SP value | What it is |
|---|---|
| Single sign-on URL (ACS) | The mobiQode SAML Assertion Consumer Service URL |
| Audience URI (SP Entity ID) | The mobiQode SAML Service Provider Entity ID |
| Name ID format | EmailAddress |
Step 2: Configure Your Identity Provider
Jump to whichever provider your organization uses.
1 In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name it “mobiQode.”
2 On the Google Identity Provider details screen, download the IdP metadata XML, or copy the SSO URL, Entity ID, and certificate shown there.
3 On Service provider details, paste in the mobiQode ACS URL and Entity ID from Step 1. Configure the Name ID to return the user’s Google primary email address.
4 Finish the SAML app setup, then open the app under Web and mobile apps → User access and turn it ON for everyone or for your test user’s organizational unit/group.
| Google Workspace field | Value from mobiQode |
|---|---|
| ACS URL | mobiQode Single sign-on URL (ACS) |
| Entity ID | mobiQode Audience URI / SP Entity ID |
| Start URL | Optional — only if your mobiQode portal provides one |
| Signed response | Leave unchecked unless your mobiQode SAML implementation explicitly requires it |
1 In the Microsoft Entra admin center, go to Entra ID → Enterprise apps → New application → Create your own application. Name it “mobiQode” and select Integrate any other application you don’t find in the gallery (Non-gallery).
2 Open the app, go to Single sign-on → SAML, and in Basic SAML Configuration enter the mobiQode ACS URL as the Reply URL and the mobiQode SP Entity ID as the Identifier.
3 In Attributes & Claims, set the Name ID (Name identifier) to the user’s email attribute — not a display name or any other identifier.
4 In SAML Certificates, copy the App Federation Metadata URL.
5 Under Users and groups, assign the users or groups who should have access.
| Microsoft Entra field | Value from mobiQode |
|---|---|
| Identifier (Entity ID) | mobiQode Audience URI / SP Entity ID |
| Reply URL (ACS URL) | mobiQode ACS URL |
| Sign on URL / Relay State / Logout URL | Optional |
1 In the Okta Admin Console, go to Applications → Applications → Create App Integration, select SAML 2.0, and name it “mobiQode.”
2 In Configure SAML, paste the mobiQode ACS URL as the Single sign-on URL and the mobiQode SP Entity ID as the Audience URI. Set Name ID format to EmailAddress and Application username to Email. Keep “Use this for Recipient URL and Destination URL” enabled.
3 Finish setup, then in the app’s Sign On tab, copy the Identity Provider Metadata URL.
4 Under Assignments, assign the people or groups who should authenticate through this app — a user cannot sign in via Okta SSO until they’re assigned.
| Okta field | Value from mobiQode |
|---|---|
| Single sign-on URL | mobiQode ACS URL |
| Audience URI (SP Entity ID) | mobiQode Audience URI / SP Entity ID |
| Name ID format | EmailAddress |
| Application username |
Step 3: Import the Metadata Back Into mobiQode
This last configuration step is the same for all three providers.
1 Return to mobiQode’s SSO Configuration page and find Import IdP Metadata.
2 Paste the metadata URL you copied (Google’s IdP metadata URL, the Entra App Federation Metadata URL, or the Okta Identity Provider Metadata URL) and click Import from IdP — or upload the downloaded XML file if your provider only gave you a file.
3 mobiQode should auto-populate the Identity Provider Issuer, SSO URL, and X.509 signing certificate. Review these, then enable SSO and click Save SSO Configuration.
Step 4: Invite Users and Test the Login
Go to Organization → Team Users → Invite User, enter the same email address that exists in your identity provider, choose a role and Edit Scope, and send the invitation. If your organization requires invitation acceptance before first login, complete that first.
To test: go to the mobiQode login page, click SSO under “Continue with,” enter the organization email, and click Continue. You should be redirected to your identity provider, authenticate, and land back on the mobiQode dashboard.
- The SAML application is active in your identity provider
- The test user is enabled/assigned in your identity provider
- The test user exists in the mobiQode organization
- The email address is identical in both systems
- The SAML NameID is the user’s email address
- The ACS URL and Entity ID in your identity provider exactly match what mobiQode displays
- The IdP metadata has been imported into mobiQode
- SSO is enabled and the mobiQode configuration is saved
- You’ve tested in a fresh/incognito browser session at least once
Troubleshooting
Reference: Field Mapping by Provider
Keep this handy while you’re configuring — it maps every mobiQode SP field to its equivalent name in each identity provider.
| mobiQode (SP) | Google Workspace | Microsoft Entra ID | Okta |
|---|---|---|---|
| Single sign-on URL (ACS) | ACS URL | Reply URL | Single sign-on URL |
| Audience URI (SP Entity ID) | Entity ID | Identifier (Entity ID) | Audience URI (SP Entity ID) |
| Name ID format: EmailAddress | SAML Name ID (primary email) | Name identifier (email attribute) | Name ID format |
| Import metadata | Google IdP metadata XML | App Federation Metadata URL | Identity Provider Metadata URL |
| X.509 Certificate | Google Workspace signing certificate | Entra token-signing certificate | IdP signing certificate |
Ready to connect your identity provider?
Open SSO Configuration →Organization → Team Users → SSO Configuration
