A sales portal creates a useful boundary between representatives, customers, and Magento administrators. It also creates another account lifecycle to manage. SAML single sign-on connects those staff accounts to the company's identity provider so employees use their corporate sign-in while Magento keeps the commerce-specific permissions and customer assignments.
What the login flow does
With the SoftwareSilo SAML add-on enabled, the staff login page sends the employee to the configured identity provider. After authentication, the provider posts a signed SAML response to Magento's assertion consumer endpoint. Magento reads the mapped attributes, resolves the staff account, and starts the staff session.
The service-provider identifier, identity-provider identifier, login URL, logout URL, and public certificate must match the IdP configuration. The reply endpoint is the store's /staff_saml/index/callback route; logout uses /staff_saml/index/logout.
Map identity separately from permissions
The add-on maps IdP attributes for email, first name, last name, group, and website code. Email identifies the staff account in the normal setup. Group values can then map to a controlled set of Sales Staff attributes, for example:
- access to assigned customers or all permitted customers;
- permission to create customers;
- permission to edit cart item prices;
- the staff group used inside Magento.
A default group value handles employees whose assertion does not contain the expected group attribute. Treat it as a safe fallback role, not an administrative role.
Decide whether password login remains available
During setup, keeping username/password login available gives administrators a recovery path while metadata and certificates are tested. Once SAML works reliably, the module can disable password login for staff accounts.
That decision should include outage handling. Document who can restore access if the identity provider is unavailable, how an emergency change is approved, and how the original secure state is restored afterward. Magento admin authentication is a separate concern; this add-on targets Sales Staff accounts.
Plan employee lifecycle changes
SSO centralises authentication, but it does not remove the need for Magento-side ownership decisions. When an employee leaves:
- disable them in the identity provider;
- disable or review the Magento staff account;
- transfer primary and supporting customer assignments;
- preserve historic order attribution;
- revoke any separate API credentials;
- verify that the former account cannot establish a new session.
Read how to reassign Magento customers when a sales rep leaves for the portfolio side of this process.
Configuration checklist
- Use the final HTTPS store URL in both systems.
- Exchange identifiers and the current signing certificate exactly.
- Map a small pilot group before enabling the whole sales team.
- Keep group mappings in valid JSON and review the resulting permissions.
- Test login, logout, expired assertions, disabled staff, and a missing group value.
- Test every website separately if staff accounts are website-specific.
- Record certificate ownership and renewal dates.
SAML is a separate add-on to SoftwareSilo Sales Staff. It replaces another password prompt with corporate identity while leaving Magento responsible for customer scope, assisted-order permissions, and sales attribution.