{"article":{"id":360033185694,"url":"https://appraisd.zendesk.com/api/v2/help_center/en-us/articles/360033185694.json","html_url":"https://help.appraisd.com/hc/en-us/articles/360033185694-Single-sign-on","author_id":375072833974,"comments_disabled":false,"draft":false,"promoted":false,"position":12,"vote_sum":0,"vote_count":0,"upvote_count":0,"downvote_count":0,"section_id":360005018934,"created_at":"2019-07-29T12:39:16Z","updated_at":"2024-12-09T17:33:13Z","name":"Single sign-on","title":"Single sign-on","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2024-12-09T17:33:13Z","user_segment_id":null,"permission_group_id":852334,"content_tag_ids":[],"label_names":[],"body":"

Single sign-on (SSO) allows people to log-in to Appraisd using an account they're already using at work - which is great because they don't need to remember a new password.

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

If your organisation uses an identity provider such as Azure AD, ADFS, Okta or OneLogin, then you can set up SSO with Appraisd. Appraisd can also support any SAML2.0-enabled Identity Provider.

\n
\n
\n

If you use Azure AD, then you can simply connect to Azure using our Azure Marketplace App. 

\n

If you use Google SSO, then please follow the instructions in this help page.

\n
\n
\n

If you're using an alternative provider, then you'll need to configure SAML SSO yourself. 

\n
\n
\n

How to configure SAML SSO yourself

\n
\n
\n
    \n
  • Turn on the Single sign-on with SAML setting in the Configuration area
    • \n
\n
\n
\"mceclip1.png\"
\n
\n
    \n
  • Refresh the page and you'll now see a SAML single sign-on tab appear in the left hand column. Take note of the various different URLs on this page as you will need them later. 
    • \n
\n
\n
\n
    \n
  • In your identity provider (e.g. OneLogin) create a new application profile for Appraisd. You may need to refer to their instructions for this. When setting up the application you will need to input some of the URLs that you saw in the Appraisd configuration page.
    • \n
\n
\n
\n
    \n
  • While you're creating the application in your identity provider, you'll be given some details you need to input into Appraisd. These include: X509 certificate in Base64 format, Identity Provider Single Sign-On URL and Identity Provider Issuer URL. 
    • \n
\n
\n
\n
    \n
  • Once you've set up the application in your identity provider and copied the certificate and other URLs into the Appraisd configuration area, you need to email support@appraisd.com and ask them to allowlist your SSO provider.
    By default, Appraisd will allow SSO and your existing password-login access simultaneously, so whilst your SSO provider is being allowlisted you can still get in to Appraisd. 
    • \n
\n
\n
\n
    \n
  • You will be informed once your SSO provider has been allowlisted. To test it, log out of Appraisd and then try clicking on the Appraisd application button in your identity provider. You should be logged in to Appraisd immediately.
    • \n
\n
\n
\n
    \n
  • Once you've got SSO working, you can use the configuration area in Appraisd to allow access exclusively via SSO and switch off password access - this will make the system more secure.
    • \n
\n
\n
\"mceclip2.png\"
\n
 
\n
When your employees enter their email address, the SSO button will automatically load. 
\n
\n

\"mceclip1.png\"

\n

Troubleshooting

\n
\n
\n

Here are things to check if SSO is not working:

\n
\n
\n
    \n
  • If you find some users cannot log in using SSO but some can, then it's unlikely to be a problem with Appraisd or the way you've configured your connection with Appraisd. Instead, ask them to try a different browser, and check that they have been configured in your identity provider with the same privileges to access the application profile as you.
    • \n
  • Make sure the NameID being passed to Appraisd is set to be the user's email address
    • \n
  • Ensure the email address in the identity provider matches the email in Appraisd exactly
    • \n
  • Ensure you've selected AES256-bit encryption in your identity provider application
    • \n
\n

Other ways to login

\n

You can also login via Microsoft or Google using your login details for these. You don't need to configure anything, they will automatically be available if you have Microsoft or Google accounts.

\n

\"mceclip0.png\"

\n
\n
\n
\n
\n
\n
\n
\n
\n
"}}