0%

SSO Federation

SSO Federation Overview

SSO federation lets your users access Criteo using your organization's existing identity system — no separate Criteo credentials required. Once configured, users on your federated domain are redirected to your identity provider (IdP) login page when they access Criteo.

Criteo uses SAML 2.0 for federation. Two systems exchange metadata to establish trust:

Term

Role

Example systems

Service Provider (SP)

Criteo — the application your users want to access

—

Identity Provider (IdP)

Your organization's identity system, which authenticates users and sends Criteo a SAML assertion

Okta, Microsoft Entra ID (Azure AD), AD FS

SSO federation is available to all clients. Contact your Criteo representative to get started.

Before You Start

Gather the following before contacting your Criteo representative. Your Criteo team will ask for this information as part of the onboarding process:

What

Details

Domains to federate

The email domain(s) your users will log in with (e.g., yourcompany.com). You can start with one and add more later.

Test users

A short list of email addresses to validate the integration before going live. All test users must have an active Criteo account before testing can begin.

IdP type

Which identity provider your organization uses, and which SAML attribute you will send for user matching. Criteo recommends emailAddress.

Environment

Whether you plan to use a separate metadata file for your production environment, or whether your test and production environments share the same IdP metadata.

Target go-live date

The date you want SSO active for all users on the federated domain(s).

Finding Your IdP Values

During onboarding, you will need to share your signing certificate, IdP Entity ID, and SSO URL with Criteo. The fastest way to gather all three at once is to export your IdP's metadata XML file — it contains all of them in a single file. The guides below walk you through locating these values for the most common identity providers.

Okta

The fastest path is to download the IdP metadata XML directly from your SAML application. It contains the entity ID, SSO URL, and signing certificate in a single file.

From the Okta application configured for Criteo: go to Sign On → SAML Signing Certificates → Actions → View IdP metadata, then save the XML file.

Reference:

Microsoft Entra ID (Azure AD)

Two sources cover the values Criteo needs:

  • Enterprise app SSO page — provides the Login URL, Entra Identifier, and certificate download. Go to your enterprise application → Single sign-on setup page.

  • Tenant-wide federation metadata endpoint — often the fastest single source. Available at: https://login.microsoftonline.com/<tenant>/FederationMetadata/2007-06/FederationMetadata.xml

References:

AD FS

AD FS is on-premises software, so there is no single customer-facing guide for locating your values. You will need two separate steps:

  • Federation metadata URL — provides the entity ID and SSO endpoint.

  • Token-signing certificate — exported separately from the AD FS Management console under Service → Certificates.

Contact your Criteo representative if you need assistance interpreting these references.

References:

​What Criteo Provides

Once onboarding begins, Criteo shares a Service Provider (SP) metadata file. Use it to configure the Criteo application in your IdP. It contains the following values:

Field

Description

Audience URI (Entity ID)

Unique identifier for Criteo's SSO service

Reply URL (ACS URL)

The destination URL where your IdP sends the SAML assertion after a successful login

X509 Certificate

Criteo's signing certificate

SSO Onboarding Process

​Step 1: Request Onboarding

Contact your Criteo representative to initiate the SSO federation process. Once your request is registered, your Criteo representative will send you an intro email containing:

  • The SP metadata file and its key values — the Audience URI (Entity ID), Reply URL (ACS URL), NameID format, and X509 Certificate — which you need to configure Criteo as a Service Provider in your IdP.

  • A list of questions Criteo needs you to answer before the integration can proceed.

Forward this email to the relevant member(s) of your IT team so they can begin the IdP configuration.

Step 2: Configure Your IdP and Respond

Using the SP metadata file provided by Criteo, configure Criteo as a Service Provider in your identity provider. If your IdP supports metadata upload, you can use the file directly. Otherwise, add the individual values manually in your SAML configuration.

When your IdP configuration is ready, reply to the intro email with the following:

  1. Your IdP metadata file — attach the XML file to your response. Alternatively, you can provide the values individually:

    • IdP Entity ID

    • SSO endpoint URL

    • Signing certificate

  2. Domain(s) to federate — the email domain(s) that should use SSO (e.g., @yourcompany.com)

  3. Identity provider — the name of your IdP (e.g., Microsoft Entra ID, Okta, AD FS)

  4. User identifier — the SAML attribute Criteo will use to match users. We recommend emailAddress

  5. Test users — the email addresses of users who will test SSO before rollout

  6. Environment — whether you plan to provide a separate metadata file for your production environment

  7. Target go-live date (optional)

Step 3: Criteo Validates and Configures

The Criteo team reviews your response and validates the technical details. If anything is missing or unclear, they will follow up with you directly to resolve it before proceeding.

Once validation is complete, Criteo configures SSO for your designated test users and notifies you that testing can begin.

Step 4: Test Activation

Criteo enables SSO for your agreed test users only, not for all users on the domain yet. You will receive a URL via email to begin testing. The URL is the address of the Criteo platform where your account is located:

  • marketing.criteo.com for Commerce Growth and Criteo Go

  • retailmedia.criteo.com for Retail Media (Commerce Max / Commerce Yield)

  • commercegrid.criteo.com for Commerce Grid

SSO is activated per user during this phase. Your other users continue to log in as normal until go-live.

Step 5: Testing

Your test users log in via the URL shared by Criteo and verify that:

  • They are redirected to your IdP login page.

  • After login, they are redirected to their Criteo account.

  • They can see the right accounts and data.

If anything is wrong, share screenshots or error messages with Criteo via the same email thread. The integration can be reverted on request during this phase.

Step 6: Go Live

Once all test users can log in successfully, Criteo activates SSO for all users on your federated domain(s) on the agreed date.

If something goes wrong after go-live, contact Criteo to roll back or fix the configuration.

SSO Ongoing Maintenance

Some fields are set during initial onboarding and rarely need to change. Others require periodic updates during the lifetime of the integration.

Rarely Changed

These are set during onboarding and stay stable:

  • SP Entity ID

  • SP ACS/Reply URL

  • IdP Entity ID

  • SAML attribute used for user matching

​Updated Over Time

Field

Why it changes

Criteo's SP signing certificate

Valid for five years from issuance. Criteo will notify you when a renewal is needed.

Your IdP signing certificate

Lifetime varies by your IdP configuration. Rotate it before it expires — share the updated metadata file with Criteo in advance.

Federated email domains

You may add new domains or remove old ones after go-live.

IdP metadata

May need updating if you migrate IdP systems or change environments.

To update any of these fields after go-live, contact your Criteo representative.

0%