Skip to content

Branding and SAML

Branding records associate a portal host URL with login presentation, resource links, logo assets, feature rollout flags, and optional SAML 2 identity-provider configuration.

Open General Administration, locate General System Administration Settings, and select Branding.

Identity

Choose an existing branding record or Add New Branding Item, then configure:

Field Guidance
Login Title User-facing portal title. Use approved organization and product wording.
Site URL Host URL used to identify the branding experience and generate SAML service-provider metadata. Enter the canonical production URL.
Enable Host Improvements Enables the branding-specific host experience rollout. Test affected host workflows before broad use.
Enable Access Control Improvements Enables the branding-specific access-control rollout. Validate credentials, assignments, and transactions.

Login Title and Site URL are required. The editor does not validate URL syntax, reachability, uniqueness, HTTPS, DNS, or certificate coverage. A valid-looking but incorrect URL can break branding selection or SAML metadata.

There is no delete action for a branding record. Coordinate retirement through the approved platform process so active host names, identity configuration, and users are not orphaned.

Enter a Link Title and Link URL and select Add Link. The link is only queued in the grid; select the main Save Item action to persist it.

Remove marks a saved or pending link for removal, and Undo Remove reverses that pending choice. Removal is applied during the main save. The editor checks only that title and URL are nonblank; it does not validate the protocol, destination, safety, or availability.

Note

In the current resource grid, the Link Title and Link URL headings can appear over the opposite stored values. Verify the entered title and URL from the input fields and test the published link after saving.

Use HTTPS and an approved destination. Avoid links that expose internal systems, rely on personal accounts, or redirect unexpectedly.

SAML configuration

Enable SAML 2 Integration Enabled only after coordinating with the identity-provider administrator. When enabled, Save requires:

  • Identity Provider ID;
  • Identity Provider URL;
  • X.509 identity-provider certificate;
  • attribute keys for Username, User Role, First Name, and Last Name.

Email, primary phone, secondary phone, and the TEKControl username prefix are optional in this form but may be required by the organization's provisioning and support process.

Claim names are exact and case-sensitive at many identity providers. The role claim can affect authorization, so map only approved values and test least-privileged, administrator, missing-claim, and invalid-claim scenarios.

Download service-provider metadata

Download Metadata File generates metadata.xml using the Site URL currently in the form and the application's SAML configuration. It does not require the branding record to be saved first.

  1. Enter the canonical Site URL.
  2. Download the metadata.
  3. Provide it to the identity-provider administrator through an approved channel.
  4. Configure the identity provider and upload its certificate.
  5. Complete claim mappings.
  6. Save the branding record.
  7. Test sign-in in a separate browser session before changing the existing production route.

Downloading metadata does not enable SAML or verify that either side trusts the other.

Uploads begin automatically but remain pending in the editor until the main save.

  • Select X509 Certificate replaces the stored identity-provider certificate when saved.
  • Select Logo replaces the branding logo when saved.
  • The existing logo is previewed when an established record is opened.

The editor does not visibly validate certificate subject, issuer, expiration, key use, file format, or logo dimensions and content type. Validate these externally. Never upload a private key; this field expects the identity provider's public certificate.

Save and verify

The save operation persists the branding record first, then the logo, resource-link changes, and SAML configuration. If an error occurs after the first step, the branding title or URL may already be saved while another part is incomplete.

After every save:

  1. Reopen the branding record.
  2. Verify title, URL, flags, links, SAML fields, certificate selection, and logo.
  3. Test the exact branded URL.
  4. Test local or recovery authentication before and after SAML.
  5. Confirm users receive the correct identity, role, and contact claims.

Do not disable the only working administrator sign-in method until a tested recovery path exists.