- 05 Mar 2024
- 2 Minutes To Read
-
Print
-
DarkLight
-
PDF
Whatfix Single Sign On
- Updated On 05 Mar 2024
- 2 Minutes To Read
-
Print
-
DarkLight
-
PDF
Whatfix supports login with Single Sign-On (SSO). SSO is an authentication process that enables users to access multiple applications with one set of login credentials.
Contact support@whatfix.com to enable SSO for your Whatfix account. There is no configuration required from your end to activate SSO for your Whatfix account.
How does SSO work in Whatfix?
- SSO-enabled enterprises have the following login screen:
- When you click LOGIN WITH SSO, you are redirected to the configured Identity Provider.
- Once you enter the credentials of the Identity Provider, it is verified and you are then redirected to the Whatfix account.
Identity Providers supported by Whatfix
An Identity Provider (IdP) is an authority system that holds and verifies the user authentication information. Whatfix interacts with your IdP and trusts the information provided by the IdP to gain access to the application. Whatfix supports the following identity providers:
- Okta
- PingFederate
- Azure Active Directory
Any identity provider compliant with SAML 2.0 works with Whatfix SSO.
Where is the SSO login available?
You can log in with SSO on the Whatfix homepage.
Requirements to enable SSO on your account
The following information has to be exchanged with Whatfix.
Information | Detail | Example |
---|---|---|
The organization provides this information |
Enterprise Name* | XYZ corp |
IdP EntityId* | https://app.onelogin.com/saml/metadata/905b5aec-defd-4f7a-a910-dae67c220cbe | |
IdP SSO Service URL* | https://ddash.onelogin.com/trust/saml2/http-post/sso/884595 | |
X509 certificate* |
|
|
SAML identity location*
(If the NameID is not available, you can provide the attribute element instead) |
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat> OR <saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="User.email"> |
|
Whatfix provides this information |
Identifier/Audience URI/Entity ID | whatfix |
ACS URL* | https://whatfix.com/saml_auth/?service=samlFromIdp | |
ACS URL* (EU Dashboard) | https://eu.whatfix.com/saml_auth/?service=samlFromIdp | |
Sign-on URL* | https://whatfix.com/xyz-test
Your title goes here
|
|
Relay state* |
https%3A%2F%2Fwhatfix.com%2Fxyz-test%2F@d5f2f450-94b9-11e8-8f2f-04013d24cd02 |
|
|
Relay state* (EU Dashboard) |
https%3A%2F%2Feu.whatfix.com%2Fxyz-test%2F@d5f2f450-94b9-11e8-8f2f-04013d24cd02 |
* The value of each detail varies for every organization. For more details, contact support@whatfix.com.
- Logging in via IdP is not supported when you have multiple accounts or ENTs. This is because the Sign-On URL is different for each account, or ENT.
- You cannot configure both non-EU and EU Whatfix accounts simultaneously via SSO login since the ACS URL domain is different for non-EU and EU accounts.
- SSO users can't see the Change Password option in the admin menu. Any password changes need to be performed at the Identity Provider level.
- Every time a user clicks LOGIN WITH SSO, they are redirected to their Identity Provider's login page.
- Currently, Whatfix does not support SLO (Single Log Out). When a user signs out of a Whatfix account, it does not log them out of the IdP.
- The user has to provide configuration parameters for Whatfix to establish an interface with their identity provider.
If a user has access to more than one enterprise(ENT) and logs into any one of them using SSO, they are automatically logged into all the other SSO-enabled ENTs that they have access to. Thus, they can switch between enterprises from their Whatfix Dashboard.
![](https://cdn.document360.io/a268766e-d74d-4619-9613-e2472f809ffb/Images/Documentation/2023-01-30_12-09-04%20(1).gif?sv=2022-11-02&spr=https&st=2024-09-08T01%3A16%3A47Z&se=2024-09-08T01%3A26%3A47Z&sr=c&sp=r&sig=6X%2BoNX%2B%2B1kd6PvrtLUzMLwqk0EkrlOe0InxJremR4IE%3D)
Use your organization's SSO to authenticate end users
If your organization has strict security policies that do not enable showing sensitive content to anyone apart from the required audience, you can add an additional layer of security between Whatfix and your end users. You can use your organization's SSO to authenticate your end users before they start seeing Whatfix content. For more information, see End-user authentication.