On-premise SAML entity id configuration doesn't work

Self Hosted Retool
1

I'm working with an on-premise Retool deployment on Heroku, and I want to have it use our own IDP. Following the docs on https://docs.retool.com/docs/sso-google-and-okta, I set SAML_SP_ENTITY_ID to a custom entity through the Heroku environment, but it doesn't seem to replace the default https://tryretool.com entity. Is the documentation outdated, or perhaps this doesn't work with Heroku deployments?

2

Hi @chris-wu! are you saying that the newly specified SP entity ID isn’t being replaced in the metadata.xml? Or it’s not being replaced in the entity ID of the actual SAML AuthnRequest?

3

It’s not being replaced in the entity ID of the SAML AuthnRequest. Also, while I do see the setting for importing IDP metadata xml, I don’t see the option mentioned in the documentation to export Service Provider metadata. In my case, I did not need to export Service Provider metadata (I’m using Auth0 as IDP). If this helps, I’m using Retool version v2.53.37 (not by explicitly choosing it, it was just the latest available for on-prem at the time).

4

Oh ok - nice choice on Auth0! Give me a few while I retrace your steps, but thanks for this detail/very helpful

5

Hi @chris-wu , a few follow-on questions please -

  1. In Auth0, did you connect to Retool using an Auth0 Application with a Saml2 Web App add-on?
  2. Out of curiosity, what are you trying to change the SP Entity ID value to/what is the reason https://tryretool.com won’t work?
6
  1. Yes I’m using the Saml2 web app add-on.
  2. I’m trying to change it to https://{redacted name of startup here}-retool.herokuapp.com
7
  1. I’m trying to change it to https://{redacted name of startup here}-retool.herokuapp.com
8

No non-alphanumeric characters besides the hyphens.

9

If I configure the Auth0 saml2 web app to accept https://tryretool.com, it then sends the SAML response to https://tryretool.com instead of my heroku deployment.

10

This is my first experience with SAML so I’m learning on the fly here.

11

Totally fair, happy to walk through it with you! Actually, would you be willing to hop on a video call sometime to go over this config, and I can compare what’s on my side to yours? Let me know if so and I can message you separately to book a time -