Learn how to connect your Authentik app with Better Stack to enable single sign-on (SSO) for you and your colleagues.

SSO setup

1. Go to Single Sign-On configuration.
2. Click Connect on the Generic SAML SSO panel and select Authentik.
3. Note the Entity ID and ACS URL. You will need them in a moment.

In Authentik

1. Sign in to your Authentik administration.
2. In the left menu, go to Customization -> Property Mappings.
3. Click Create, select SAML Property Mapping, and enter the following:
   • Name: email
   • SAML Attribute Name: email
   • Expression: return request.user.email
4. Click Finish.
5. In the left menu, go to Applications -> Providers.
6. Click Create, select SAML Provider, and enter the following:
   • Name: The Entity ID from Better Stack.
   • Authentication flow: Select the default authentication flow.
   • Authorization flow: Select the default provider authorization flow.
   • ACS URL: The ACS URL from Better Stack.
   • Issuer: betterstack
   • Service Provider Binding: Redirect
7. Open Advanced protocol settings:
   • For Signing Certificate, select authentik Self-signed Certificate.
   • In Property mappings, select the email mapping you just created.
8. Click Finish.
9. In the left menu, go to Applications -> Applications.
10. Click Create and enter the following:
    • Name: Better Stack
    • Slug: better-stack
    • Provider: Select the provider you just created.
11. Click Create.
12. In the left menu, go to Applications -> Providers and click on your newly created provider.
13. Copy the SSO URL (Redirect).
14. Go to the Metadata tab and copy the content of the <ds:X509Certificate> element.

In Better Stack

1. Paste the SSO URL (Redirect) into the Identity Provider Single Sign-On URL field.
2. Paste the certificate content into the X.509 Certificate field.
3. Click Connect. You will be redirected to Authentik to sign in.

You're done. Your Authentik Single Sign-On is now configured.

Rotate your identity provider certificate

When you rotate the certificate in Authentik, replace it in Better Stack too:

1. Sign in to Better Stack as an admin before you switch certificates. Until you save the new one, new SSO sign-ins fail. Team members who are signed in stay signed in.
2. In Authentik, select the new certificate as the Better Stack provider's Signing Certificate and copy it from the Metadata tab.
3. Go to Single Sign-On settings
4. Expand Advanced settings.
5. Replace the content of the X.509 Certificate field with the new certificate.
6. Click Save changes.