Managing SSO with Mixed Authentication / Multiple Provider Single Sign-On
LAUNCHING SOON!
Path: Manage Workspace >> Security >> Authentication
Mixed Authentication:
This feature allows you to set up your community with mixed authentication i.e user can either login using Single Sign-On (depending on user added to the active directory) or IdeaScale login.
1. Enabling IdeaScale Email/Password login option
Once you have setup your SSO SAML 2.0 / 3.0 in your workspace, under Security >> Authentication you can enable 'Ideascale Email/Password Login' option and select all members or respective group from 'Members Allowed For Ideascale Email/Password Login' dropdown under Community Settings >> Security >> Community Access Rules. This will allow either all members or selected members linked to a specific group to login via SSO as well as login with IdeaScale (SSO being the default login type).
You can also specify the groups you do not want to allow access using IdeaScale Email/Password option using 'Groups Not Allowed For IdeaScale Email/Password Login' option.
Click on the space given and add from the groups name is shown in the dropdown list.
2. Workspace Registration
By default, the system does not allow new users to register to the SSO workspace. Though you can turn ON Manage Workspace >> Workspace Configuration >> Workspace Info>> General Info >> Allow Workspace Member Registration to allow new users to register to the workspace and login via IdeaScale login/password.
Users will see the option to Register
Click on Register link to go to the registration page. See our help article https://help.ideascale.com/registration-process for details on how to complete the registration process.
User Experience with mixed SSO:
User will see options to login using SSO as well as to Continue with email button.
If you click on Log in With SSO account button, you will be taken to the SSO login page. You can use the SSO credentials to login to your community.
If you click on Log in With IdeaScale button member will be taken to the standard IdeaScale login page. They can use their IdeaScale login credentials to login to the community.
Multiple Provider Single Sign-On:
IdeaScale supports Multiple Provider SSO along with the Single Sign-On for the community. Each community will have the settings to enable/disable the Multiple Provider SSO and have multiple IDP configuration. IDP configuration can be added/ edited/deleted from community settings by the administrator.
How It works:
If the Multiple Provider SSO is enabled, the community login page will have a list showing us a list of enabled IDP configured. Users can select the desired method to login to the community.
When a community is set up with Multiple Provider SSO the user will get a screen like the above image. You simply need to select the appropriate SSO and login.
To learn more about SAML and setup, go through the help articles below:
https://help.ideascale.com/knowledge/saml-single-sign-on-at-ideascale
https://help.ideascale.com/knowledge/saml-sso-with-active-directory-and-adfs-2.0-/-3.0