Skip to content
English
Go to ideascale.com
  • There are no suggestions because the search field is empty.

SSO Login Condition Attributes

Quick Tip for SSO Login

Path: Workspace Homepage >> Navigation Panel >> Settings >> Security >> Authentication >> Single Signon Settings >> More option >> Login Condition

What are Login Condition Attributes?
Login Condition Attributes are identity attributes sent by an Identity Provider (IdP) during Single Sign-On (SSO) login that IdeaScale, acting as the Service Provider (SP), evaluates to make access control decisions.

Login Condition Attributes allow a Workspace Administrator to restrict Single Sign-On (SSO) login access based on a specific attribute value transmitted by the Identity Provider (IdP) — such as an email address, username, or department — rather than granting SSO access universally to every authenticated member. Because attribute names and formats vary by Identity Provider (IdP), each Login Condition Attribute must be configured individually to match the connected IdP's configuration (see Exceptions below).

Role Permissions

  1. Workspace Administrator: Configures Login Condition Attributes under Single Signon Settings, defining the Attribute Name and Attribute Value used to restrict Single Sign-On (SSO) login access.
  2. Community Administrator: Can enable or disable SSO on their community, set up by the workspace administrator.
  3. Member: Is granted or denied Single Sign-On (SSO) login access depending on whether the attribute values received from the Identity Provider (IdP) match the configured Login Condition Attribute.

TABLE OF CONTENTS

Accessing Login Condition
Configuring Login Condition Attributes
Example: Restricting Access by Email Pattern
Exceptions
Frequently Asked Questions

Accessing Login Condition

Screenshot 2026-08-18 at 9.01.20 AM

  1. In the Navigation Panel, go to Settings.
  2. Select Security.
  3. Go to Single Signon (SSO).
  4. Click on the More option for the SSO set.
  5. Choose Login Condition.

Configuring Login Condition Attributes

Screenshot 2026-08-18 at 8.54.33 AM

Configuring a Login Condition Attribute involves two settings.

Attribute Name

The attribute to which a login condition is attached, such as Email, Username, or any other attribute transmitted from the Identity Provider (IdP).

Attribute Value

A regular expression or wildcard expression that defines how the Attribute Name is restricted — for example, limiting access to members belonging to specific departments within an organization.

Attribute Mapping

The added attributes will be listed in a tabular format showing Attribute Name, Attribute Value and Actions.

Match Rules During SSO Login

Workspace Administrators can determine how Login Conditions are applied during Single Sign-On (SSO) login by selecting one of the following settings:

All Conditions: Members can log in only when all configured Login Conditions are met.

Any Condition: Members can log in when at least one configured Login Condition is met.

Example: Restricting Access by Email Pattern

The following example illustrates blocking members with an email prefix of "atp." and an email domain of "ideascale.com" (e.g., atp.ideascaleuser@ideascale.com):

  1. Define the Attribute Name as the Identity Provider (IdP) attribute associated with email. This attribute is expressed differently depending on the IdP; the Help Article for SSO Debugger can be used to confirm how it is transmitted for a given connection. For Azure AD, this attribute appears as: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
  2. Define the Attribute Value as a Regular Expression (RegEx) that blocks members with the "atp." prefix and the "ideascale.com" email domain.

Note: The example above illustrates blocking access based on a prefix-and-domain match. A Login Condition Attribute can similarly be configured to restrict access based on department or any other attribute value sent by the Identity Provider (IdP).

Exceptions

  1. IdP-Specific Configuration: A Login Condition Attribute cannot be applied universally across every Identity Provider (IdP) connection. It must be configured according to the specific IdP's attribute structure and naming.

Frequently Asked Questions

What is the purpose of a Login Condition Attribute?

A Login Condition Attribute allows a Workspace Administrator to control Single Sign-On (SSO) login access based on a specific identity attribute sent by the Identity Provider (IdP), rather than granting access to every authenticated member.

Can the same Login Condition Attribute configuration be applied to every Identity Provider (IdP)?

No. Because attribute names and formats vary by Identity Provider (IdP), each Login Condition Attribute must be configured according to that specific IdP's configuration (see Exceptions above).

How can an Administrator determine the exact attribute name being sent by the Identity Provider (IdP)?

The Help Article for SSO Debugger can be used to review the SSO debugger log and confirm how a given attribute, such as email, is transmitted by the connected Identity Provider (IdP).

What happens to a member whose attribute value matches a blocking Login Condition Attribute?

The member is blocked from completing Single Sign-On (SSO) login, based on the Attribute Value configured for the associated Attribute Name.

Related Articles

 

Last Updated: August 18, 2026