General Information
Service Provider Initiated Flow
As the Service Provider (SP), Global-e initiates the sign-on flow.
 |
Flow:
The end-user accesses the Global-e Merchant Portal and enters only their employee email address:
Global-e Merchant Portal URL: https://web.global-e.com/account/ssologin
Merchant employee email example:
See Screens: Accessing the Global-e Service Provider.
Global-e SP generates a SAML request together with the employee’s email included in
RelayState.
The Global-e SP initiates a SAML redirect to the end-user web browser. This means that when the user clicks login, the user is redirected to the Identity Provider sign-in page and prompted to enter the username and password.
The end-user browser relays the SAML request to the Identity Provider (IdP).
IdP identifies and authenticates the user: IdP parses the SAML request IdP stores the
RelayStatevalue (user email address).IdP generates a SAML assertion (XML document containing the user authorisation) and returns it with the user's email address to the user's browser. The assertion document must include the required list of roles supported by the Global- Merchant Portal. See User Roles.
The user browser returns the SAML assertion to the Global-e SP together with the user email.
Global-e SP validates the SAML response:
Decrypts the SAML response
Parses the
RelayStateParses the Role List (see Role List)
Checks if the user exists by searching for the user e-mail received in RelayState as part of the SAML response.
Checks the roles of the user
Creates the user if the user does not exist
If the user is validated, Global-e SP creates an authentication token and passes it in a cookie to the user's browser.
The user is redirected to the Global-e Merchant Portal: https://web.global-e.com/GlobaleAdmin.
Global-e pages are accessible based on user role.
User Interface
The user accesses the Global-e Merchant Portal by entering only their employee email address (merchant domain).
Example: [email protected]
Accessing the Global-e Service Provider (Global-e SP)
When the user clicks login, Global-e redirects them to the IdP Sign-in page (see IdP Sign-in and Authentication Example below), where they enter user credentials (email and password). IdP identifies and authenticates the user before granting access to the Global-e Merchant Portal based on user role.
IIdP Sign-in and Authentication (Example)
Accessing the Global-e Merchant Portal
Supported Binding
Global-e SP supports HttpGet and HttpPost binding for the single sign-on.
Global-e Identifier
The Identifier allows the Merchant’s IdP to identify Global-e as a Service Provider.
This Global-e SP entity identifier is a fixed value represented as follows:
Production:
9c41258e-0c9d-43b4-ba15-242b139011fd
Staging:
0d1821aa-309a-4314-b5fe-b4a7c3debbe8
Example:
The following SAML request XML attribute specifies the Global-e SP entity identifier:
entityID=https://wwww.global-e.com/9c41258e-0c9d-43b4-ba15-242b139011fd
Metadata
SAML supports metadata endpoint link exchange between IdP and SP, where IdP provides the Global-e SP with the link to the XML publicly available metadata and vice versa. This simplifies the setup process.
One way to configure such a relationship is to exchange metadata files between the SP side and IdP via metadata links, where the SP side can receive an IdP metadata file and generate an SP metadata file for consumption by IdP.
Global-e Metadata
Global-e SP exposes SAML metadata either via a link or via a file that can be downloaded from the link.
The Global-e metadata includes the following parameters:
The SP entity id
An endpoint to redirect the end user for
HttpGetbinding:Production: https://secure.global-e.com/account/externallogin
An endpoint to redirect the end user for
HttpPostbinding:Production: https://secure.global-e.com/account/externallogin
A public certificate and signature for signing and encryption
Global-e contact details
Note
Contact Global-e if you are not sure whether to use the values for Production, Staging, or QA-INT.
IdP Metadata
Global-e gets the IdP metadata by accessing the link sent by IdP.
The IdP metadata initiates a SAML request.
The IdP metadata includes:
An IdP redirect URL (for SAML Request)
A IssuerID
An IdP logout endpoint link
A public certificate and a signature for signing and encryption
Endpoints
The Global-e SP metadata is accessible either through the URL or via a file available for download. This metadata provides IdP with the necessary information to communicate with Global-e.
To access the Global-e SP Metadata:
Example of Global-e SP Metadata:
To Download the Global-e SP Metadata File:
SAML Response
IdP transfers the SAML response to the Global-e SP endpoint that supports both HttpGet and HttpPost SAML bindings: https://secure.global-e.com/account/externallogin