Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Set up single sign-on for your organisation

Let your team sign in with their existing work accounts by connecting your identity provider.

Before you start

You need to be a Licence Manager with permission to manage users on your licence. If you do not see Manage Single Sign-On in the Actions panel on your licence page, your licence may not have self-service SSO enabled. Ask your Licence Manager to contact our support team to have it switched on.

Your organisation's email domains must also be linked to your licence before you can select them for single sign-on. If no domains appear in the form, contact our support team.

Steps

  1. Open your licence page and click Manage Single Sign-On. From your licence page, find Manage Single Sign-On in the Actions panel and click it.
  2. Choose a configuration identifier and start the setup. Enter an identifier for your SSO configuration in the Configuration identifier field. This appears in your SSO URLs and cannot be changed afterwards. A suggested identifier based on your licence is shown by default. Click Start SSO Configuration.

  3. Give the generated details to your identity provider administrator. The page now shows the details your identity provider needs to register the application as a service provider. Copy the Identifier (Entity ID), Reply URL (ACS URL), Sign-on URL and Logout URL and give them to the person who manages your identity provider (for example Azure AD, Okta or ADFS). They will also need to map the email, first_name and last_name claims, and add a custom claim named user_secret with a value only your organisation knows.

  4. Enter your identity provider's details and select your email domains. Once your identity provider administrator has registered the application, they will give you a metadata XML file or the sign-on URL and certificate fingerprint. Upload the metadata file under Upload identity provider metadata to fill in the fields automatically, or enter the Sign-on (SSO) URL and Certificate fingerprint (thumbprint) by hand. The Sign-out (SLO) URL is optional. Then tick each email domain that should use single sign-on, and click Save SSO configuration.



What happens next

Users whose email address matches one of the selected domains will be redirected to your identity provider's sign-in page when they next sign in. They will not need a separate password.

The configuration applies to your entire licence, not to individual workspaces.

Good to know

  • The configuration identifier becomes part of your SSO URLs. Choose something recognisable, such as your organisation's name or abbreviation.
  • If your identity provider gives you a metadata XML file, uploading it is the easiest way to fill in the form. You can still check and edit the fields by hand afterwards.
  • The user_secret claim is required and must never be changed once users have signed in with SSO. Changing it will lock them out.
  • If your organisation already has a custom SSO setup managed by support, the self-service page will tell you to contact support for changes.

Questions

What if I need to change the SSO configuration later? You can return to Manage Single Sign-On at any time to update the identity provider details or change which email domains use single sign-on. The configuration identifier cannot be changed.

What if I chose the wrong configuration identifier? The identifier cannot be changed after you click Start SSO Configuration. If you need a different one, contact our support team.

Need help? Please contact our support team at support@safelinkhub.com.