Integrate Smartsheet
Smartsheet is a software service used to assign tasks, track project progress, manage calendars, share documents, and manage other work, using a tabular user interface (see https://www.smartsheet.com/). You can protect access to Smartsheet by integrating Smartsheet with Identity as a Service. Once integrated, users can use single sign-on to log in to their Smartsheet account through Identity as a Service.
Note: This integration was tested using Identity as a Service version 5.15 and Smartsheet 120.0.1. Other versions of Smartsheet may require integration and configuration steps that differ from those documented in this procedure. For other versions of Smartsheet, this integration guide may be used as an initial approach for integrating Smartsheet. In the event of other issues, contact support@entrust.com for assistance.
To integrate Smartsheet with Identity as a Service, you must do the following:
Step 1: Copy the Entity ID and Assertion Consumer Service URL from the Smartsheet metadataStep 1: Copy the Entity ID and Assertion Consumer Service URL from the Smartsheet metadata
In a Web browser enter:
www.smartsheet.com/sites/default/files/smartsheet-saml2-sp-metadata.xml
Open a text editor such as Notepad.
Copy the value for the entityID and paste it in the text file.
https://sso.smartsheet.com/saml
Copy the Location value for the <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" and paste it in the text file.
https://sso.smartsheet.com/Shibboleth.sso/SAML2/POST
Save the text file. You need this information in Step 2: Add Smartsheet to Identity as a Service.
Step 2: Add Smartsheet to Identity as a ServiceStep 2: Add Smartsheet to Identity as a Service
Add Smartsheet to Identity as a Service for single sign-on
Log in to your Identity as a Service administrator account.
Click 
> Security > Applications. The Applications Lists page appears.
Click Add. The Select an Application Template page appears.
Do one of the following:
Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
- or -
In the Search bar, enter a search option to filter for the application you want to add to IDaaS.
Click Smartsheet. The Add Smartsheet page appears.
Enter an Application Name.
Enter an Application Description.
Optional. Add a custom application logo.
Click 
next to Application Logo. The Upload Logo dialog box appears.
Click 
to select an image file to upload.
Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
If required, resize your image.
Click OK.
Select the Authentication Flow that appears to users during login.
Click Next. The General page appears.
In the Default Assertion Consumer Service URL enter the ACS URL Location you copied in Step 1: Copy the Entity ID and Assertion Consumer Service URL from Identity as a Service.
https://sso.smartsheet.com/Shibboleth.sso/SAML2/POST
In the Service Provider Entity ID (Issuer) field, enter the entityID you copied in Step 1: Copy the Entity ID and Assertion Consumer Service URL from Identity as a Service.
https://sso.smartsheet.com/saml
Optional. Enter the SAML Username Parameter Name used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.
Enter the SAML Session Timeout to the time when the SAML Assertion times out. The maximum is 720 minutes.
Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.
From the SAML NameID Attribute drop-down list, select User ID.
From the SAML NameID Encoding Format drop-down list, select Persistent.
From the SAML Signature Algorithm drop-down list, select SHA256.
From the SAML Signing Certificate, select the signing certificate.
Select Sign Complete SAML Response.
Deselect Enable Go Back Button if you do not want users to be able to go back to the Smartsheet login page to log in.
Optional. Add Alternative Assertion Consumer Service URLs, as follows:
Click Add.
Enter a Name.
Enter a URL Value.
Select Show in My Profile to display the Alternative Consumer Service URL in a user's My profile page.
Optional. Add an Application Logo.
Click Add.
Repeat these steps to add more Alternative Assertion Consumer Service URLs.
Add an Email SAML Attribute. This attribute is mandatory.
Under SAML Attributes, click Add. The SAML Attributes dialog box appears.
In the Name field enter
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Click Add next to Value(s).
In the Values field type < and select <Email> from the drop-down list.
Click Add.
Optional. Repeat steps a to e the following first name and last name attributes:
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Value: <First Name>
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Value: <Last Name>
Click Submit.
Step 3: Add a resource ruleStep 3: Add a resource rule
Step 4: Download the metadata from Identity as a ServiceStep 4: Download the metadata from Identity as a Service
Download the Metadata file from Identity as a Service
In Identity as a Service, click > Security > Applications. The Applications List page appears.
Do one of the following:
Click 
next to the application you are integrating with Identity as a Service.
–or–
Click 
next to the application you are integrating with Identity as a Service and select SAML IDP Metadata.
The SAML Application Metadata dialog box appears.
Select the certificate to include in the SAML IDP Metadata file from the drop-down list.
If applicable, Select the domain to include in the SAML IDP Metadata file from the drop-down list.
Enter the Lifetime, in days, for the SAML IDP Metadata file. The value must be between 2 and 730.
Do one of the following, as required:
Copy the Public Endpoint to paste into your SAML application being used Identity Provider authentication.
Click Download.
Note: If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.
Step 5: Upload the Identity as a Service metadata to SmartsheetStep 5: Upload the Identity as a Service metadata to Smartsheet
Log in to your Smartsheet administrator account. The Sheets page appears.
Click your profile and select Admin Center from the drop-down list. The Smartsheet Admin Center appears.
Scroll to Authentication and click SAML. The Authentication page appears.
Select SAML and then click Edit Configuration. The SAML Administration page appears.
Click Add IdP. The Add IdP page appears.
Enter an IdP Nickname.
Open the metadata file you downloaded in Step 4: Download the metadata from Identity as a Service.
Copy the entire contents of the metadata file.
Paste the contents in the IdP Metadata field.
Click Save.
Step 6: Test the integrationStep 6: Test the integration
Testing Service Provider Login
Open a Web browser and enter the URL for your Smartsheet account. You are directed to Identity as a Service.
Enter your Smartsheet account User ID and click Next.
Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to Smartsheet.
Testing Identity as a Service redirect log in
Log in to your Identity as a Service account.
Go to your My Profile page if you are not already there.
Under Applications, click Smartsheet.
Respond to the second-factor authentication challenge. If you respond successfully, you are logged into Smartsheet.