Configure ADFS or Ping Federate as an Identity Provider for Quip SSO

This article explains how to configure Microsoft Active Directory Federation Services (ADFS) or Ping Federate as a SAML identity provider for Quip single sign-on (SSO). It lists the requirements, the configuration steps, and answers to common questions. Before you start, review the guide Quip SAML Single Sign-On (SSO) Setup Overview for additional information on the process, as well as recommended guidelines.

Requirements to configure ADFS or Ping Federate for Quip SSO

• A Quip Admin role. If you do not know your Quip Site Admin, create a case with Quip Support.
• Quip Plus or Quip Advanced licenses.
• An ADFS or Ping Federate instance.

Steps to configure ADFS or Ping Federate with Quip

1. Download the Quip metadata from the Quip Admin console.
   • Click Settings, and select Accounts & Access.
   • Click the highlighted portion, "For entity ID and destination URL, download Quip's metadata," to start an immediate download.
2. Use the Quip metadata file to configure your instance.
   • When configuring your Identity Provider, the best recommendation for Name ID format is Email Address and Unspecified.
     • Quip allows Transient, Persistent, Email Address and Unspecified for the Name ID Format.
     • If you are unable to use these additional Name ID formats, use Email Address to Unspecified as the incoming and outgoing Name ID format to troubleshoot.
3. Add your users to the directory within the Identity Provider.
   • Make sure that your users' emails exactly match the email listed on their Quip Account.
   • SAML can be case-sensitive.
4. Create a New Configuration within the Quip Admin Console under Settings, Accounts & Access.
5. Name the Configuration and upload the newly configured metadata file from your Identity Provider.
6. Enter the email you are currently logged in with into the Test Email text box.
   • A popup window prompts you to log in to your Identity Provider.
   • Once this test is successful, select 'Continue'.
   • If you see a failed status, double check that you are assigned to the application created in your Identity Provider.
7. Select Enable for Test Users or Enable for Entire Company.
   • If you would like to Enable for test users, make sure to enter email addresses separated by a comma.
   • Double-check that additional spaces have not been added between these emails.
   • If you select Enable for Entire Company, the configuration is immediately assigned to all site members.
   • Double-check that all users have been assigned to the configuration properly.
8. Once you select Continue, your configuration is enabled.

FAQs about Quip SSO with ADFS or Ping Federate

How do I enable the SAML configuration for all users after testing?

Once you are done testing your SAML setup, select the dropdown on your configuration within the Quip Admin Console and select "Manage". Then select "Enable for Entire Company" and save to apply the configuration to all of your users. All of your users are then directed to log in with their corresponding Identity Provider credentials.

What if uploading the metadata file does not work?

If uploading the metadata file within your Quip configuration does not work, you can manually paste the configuration into a textbox by selecting 'Configure manually'.

What is the difference between IdP-initiated and SP-initiated flows in Quip SAML?

The Quip SAML configuration allows users to complete either an Identity Provider (IdP) Initiated Flow or a Service Provider (SP) Initiated Flow.

• The IdP-initiated flow allows users to click on the newly created tile in your Identity Provider to launch Quip.
• The SP-initiated flow allows users to open Quip.com and log in with their email address.

Why does the IdP-initiated flow show an error when I use the Test User option?

If you are using the Test User option in the Quip SAML configuration, you will see an error when using an IdP-initiated flow, because the configuration is not fully enabled.

• The Quip configuration needs to be set to Enable for Entire Company and saved to allow the tile to work.
• Enabling the configuration for your entire Quip site as a test when users are offline is recommended.
• You can edit the current configuration by opening the Quip Admin Console, clicking on the Accounts & Access tab, and clicking on the drop down for the desired SAML configuration.
• You can then select Manage Configuration to edit the additional settings for Entire Company or for Test Users.

Can I configure more than one Identity Provider for a Quip site?

Admins cannot configure more than one Identity Provider to one Quip site.

• If you have an Identity Provider configured to other applications, it is recommended to use that same Identity Provider with your Quip site.
• Only one configuration in Quip can be enabled at a time. Enabling multiple SAML configurations in Quip at once is not supported.

How do I update my SAML configuration certificate?

If you need to update your existing SAML configuration certificate, follow the guide How to Add/Update a New SAML Certificate for Quip.