We support single sign on using SAML 2.0. Instead of relying on our local authentication for password and security policies, you may set your own authentication using your managed Identity Provider.

IdP Configuration

We use SAML 2.0 and support IdP-initiated flows only. Therefore, to authenticate, the IdP must allow the SAML Assertion to be used. The SSO application needs to be created in your IdP provider before enabling SSO in the platform.

The following are quick guides for setting up common IdPs:

• Creating an App Integration for SSO in Okta 
• Creating an Application for SSO in Azure 
• Creating a Connected App for SSO in Salesforce 
• Creating a SAML App for SSO in Google Workspace 
• Creating an SSO Application in Ping 

Enabling Single Sign On (SSO):

1. Log in to the Own Data Platform.
2. Click  in the bottom left corner of the screen.
3. Click Change to Single Sign On (SSO). The SSO Settings will open on the right of the screen:
   
4. Enter the Identity Provider Issuer: A unique identifier of the IdP (Usually an https:// URL). The SAML issuer is typically the Entity ID, which can be verified in the IdP’s metadata xml.
5. Upload the IdP Signature Certificate. Your certificate should be an X.509 PEM encoded file.
6. (Optional) Enter the Logout URL: The link to where you wish to direct users, when clicking the logout button.
7. Click Next.
   It may take a few minutes to verify your settings.
8. Once your settings are saved and your unique parameters are created, the IdP Parameters will be displayed:
   
9. Copy the values into the relevant fields in your identity provider.
   If you want all users to be logged in to a specific region on sign in, click Show advanced access and select the region specific Direct RelayState, rather than the Default RelayState.
   

10. In your identity provider, ensure that the unique user identifier (also known as name ID) points to the email address.
11. In the Own Data Platform, click Close. The following message will appear:
12. Until you complete the setup, your sign in method in the Security page will display a “Not Activated” warning:
    
    In order to complete the setup, log out and log back in to the Own Data Platform with your IdP. This will verify your settings and activate them across your account. Until this is done, users can still log in with their email and password.

If there was an issue with the SSO setup, the Master Admin user can still log in with their email and password to debug.

Once SSO is activated, logging in with email and password is disabled for all accounts.

Behavior when Enabling Single Sign On

Most password policies and security measures in the Own Data Platform change when you enable single sign on via SAML:

• Only the Master Admin can enable/disable SSO.
• The user can no longer set their password in the platform, and the password length complexity rules are those set by the identity provider.
• We cannot enforce password expirations and cannot prevent reuse of old passwords.
• Users cannot use the Forgot/Reset Password mechanism and will be referred to their Identity Provider if they try to do so.
• If you would like to enable an API user after implementing Single Sign On, please refer to Managing an API Token for your Account
• If you are completely locked out and cannot manage authentication via the IdP, please submit a case to our Support team who can assist.

Disabling SSO

1. Log in to the Own Data Platform.
2. Click  in the bottom left corner of the screen.
3. Click Change to Password. The Password Settings will open on the right of the screen:
   
4. Set your password settings and click Save.

The next time a user from your account attempts to log in, they will be forced to reset their password.

Updating SSO Credentials

If you need to update your identity provider issuer and/or certificate, the new credentials won’t activate until a user logs in with IdP.

To update your SSO:

1. Log in to the Own Data Platform.
2. Click  in the bottom left corner of the screen.
3. In the Authentication Method card, click View details.
4. The SSO Settings will open on the right of the screen.
5. Click Edit.
6. Update the SSO settings and click Next.
7. It may take a few minutes to verify your settings.
8. Once your settings are verified, the IdP Parameters will be displayed:
   
9. In order to complete the setup, log out and log back in to the Own Data Platform with your IdP.