Overview
Single Sign-On (SSO) allows users to access OnBoard using the same credentials they already use for their organization's Identity Provider (IdP). This simplifies login, improves security, and reduces the number of passwords users need to manage.
OnBoard supports SAML (Security Assertion Markup Language) based SSO integrations and can work with any Identity Provider that supports the SAML protocol.
This article covers:
- What SSO is and how it works
- Supported SSO protocols and Identity Providers
- SSO setup requirements and configuration steps
- The end-user login experience
- Required versus optional SSO
- Supporting users with non-organization email domains
- Frequently asked questions
Understanding Single Sign-On (SSO)
What is Single Sign-On (SSO)?
Single Sign-On (SSO) is an authentication method that allows users to securely access multiple applications using a single set of login credentials.
Instead of creating a separate username and password for every application, users authenticate through a central system called an Identity Provider (IdP).
Common Identity Providers include:
- Microsoft Entra ID (formerly Azure Active Directory)
- Okta
- OneLogin
- Ping Identity
- Other SAML-compatible providers
Benefits of SSO include:
- Fewer passwords to remember
- Improved security
- Faster login experience
- Centralized user account management
How does SSO work with OnBoard?
SSO works with OnBoard by allowing OnBoard to trust authentication performed by your Identity Provider (IdP).
The basic process is:
- The user enters their email address on the OnBoard login page.
- OnBoard identifies that SSO is enabled for the organization.
- The user is redirected to the Identity Provider.
- The Identity Provider verifies the user's credentials.
- The user is securely signed in to OnBoard.
This process uses an SSO protocol to exchange authentication information between OnBoard and the Identity Provider.
Supported SSO Protocols and Identity Providers
Which SSO protocol does OnBoard support?
OnBoard supports the following SSO protocol:
- SAML (Security Assertion Markup Language)
SAML is a widely used authentication standard that allows Identity Providers and applications to exchange authentication information securely.
Which Identity Providers (IdPs) does OnBoard support?
OnBoard supports any Identity Provider that communicates using the SAML protocol.
Because OnBoard supports SAML, most enterprise Identity Providers can be configured to work with OnBoard.
Preparing for SSO Setup
Who should be involved in the setup process?
To successfully configure SSO, the following stakeholders should participate in the setup process:
- Your organization's OnBoard Administrator
- Your organization's IT administrator or Identity Provider administrator
What information is required before setup begins?
Before setup begins, your IT administrator will need the information required to create an OnBoard application in your Identity Provider.
For detailed information and examples of how to manage the configuration in an IdP, review the SSO - IT - Single Sing-On Application Setup article.
For SAML configurations, your IT administrator will need to provide:
- Identity Provider Metadata URL
This URL contains configuration information that allows OnBoard and the Identity Provider to communicate.
Configuring SSO in OnBoard
How do I enable SSO for my organization?
Once your IT administrator has configured the OnBoard application in your Identity Provider, your OnBoard Administrator can complete the setup in OnBoard.
Step 1: Create the application in your Identity Provider
- Send your IT representative the following information:
- Entity ID: https://onboardmeetings.com
- Reply URL (Assertion Consumer Service URL): https://auth.onboardmeetings.com/Home/Saml2AssertionConsumerService
- Unique User Identifier (Name ID): user.mail
- Your IT representative creates a SAML application for OnBoard in your Identity Provider.
Step 2: Obtain the Metadata URL
Your IT representative should provide:
- Identity Provider Metadata URL
Step 3: Configure SSO in OnBoard
- Sign in to OnBoard.
- Select Settings.
- Select Security.
- Turn on the SSO toggle.
- Select Set Domain.
- Enter:
- Your organization's domain
- Your email address
- Check your email for the verification code.
- Enter the code.
- Select Submit.
- Select Configure Provider.
- Enter:
- Display Name
- IDP Metadata URL or IDP Metadata provided by your IT representative.
- Select Set Configuration.
Once configuration is complete, users should be able to authenticate using SSO.
How do I confirm the setup works correctly?
After configuration is complete the Admin should:
- Log out of OnBoard
- Return to the OnBoard login page: https://app.onboardmeetings.com
- Enter their OnBoard User ID.
- When prompted, select the SSO sign in button
- Complete the login process with SSO
End User Login Experience
What does the login process look like when SSO is enabled?
When SSO is enabled, users begin by entering their email address on the OnBoard login page.
OnBoard then determines whether the user should authenticate through SSO.
The login experience varies depending on the organization's SSO settings.
If SSO is Required
If SSO is required, the user's only sign-in option is to authenticate through the organization's Identity Provider.
The process is:
- Enter email address.
- Select Continue.
- Select the SSO Sign In Button (This will show the Display Name set when configuring
- Authenticate with Identity Provider credentials.
- Return to OnBoard and sign in automatically.
If SSO is not required
If SSO is not required, users may choose either
- Sign in using their OnBoard username and password
- Sign in with SSO
This flexibility can be useful during adoption or transition periods.
If a user belongs to multiple OnBoard organizations
If a user belongs to multiple OnBoard organizations, they may see multiple login options depending on how each organization is configured.
Users can choose the appropriate organization and corresponding sign-in method.
Please see this article for a more detailed step-by-step login process using SSO.
Managing Required and Optional SSO
What does it mean to require SSO?
Requiring SSO means every user must authenticate through the organization's Identity Provider before accessing OnBoard.
When SSO is required:
- Users cannot use a traditional OnBoard password.
- Authentication is controlled through the Identity Provider.
- Security policies are managed centrally by the organization.
What does it mean to make SSO optional?
Making SSO optional means users can choose between:
- Identity Provider authentication (SSO)
- OnBoard username and password authentication
This option can be helpful while transitioning users to SSO.
What should organizations consider before requiring SSO?
If your organization requires SSO, it is recommended that your IT team use each user's preferred email address during configuration.
This helps ensure users continue receiving:
- Calendar invitations
- Meeting reminders
- System notifications
- Important board communications
Proper email alignment helps prevent communication issues.
Supporting Non-Organization Email Domains
Can I set up SSO for users who do not use my organization's email domain?
Yes. OnBoard supports SSO for users whose email addresses are not part of your organization's primary email domain.
Examples may include:
- External board members
- Consultants
- Advisors
- Guest participants
How does SSO work for users with non-organization email addresses?
OnBoard matches the user's email address to an account within the organization's OnBoard Directory.
If the email address exists in the OnBoard Directory, the user can be prompted to authenticate through SSO, regardless of the email domain.
The key requirement is that the email exists in the organization's OnBoard Directory.
What should I know before requiring SSO for non-domain users?
If SSO is required:
- Every user must exist in the Identity Provider.
- Every user must be provisioned by IT.
- The email address in OnBoard must exactly match the email address or username in the Identity Provider.
- Users who are not provisioned in the Identity Provider will not be able to sign in.
This ensures a consistent and secure authentication experience for all users.
Troubleshooting SSO Configuration
How can I verify that my Metadata URL is valid?
You can verify that your Metadata URL is valid by opening it in a web browser.
If the URL is valid, you should see XML (Extensible Markup Language) data displayed in the browser.
If you receive an error such as:
- Not Found
- Page Cannot Be Displayed
- Invalid Resource
the URL may be incorrect and should be reviewed by your Identity Provider administrator.
Frequently Asked Questions
What is an SSO protocol?
An SSO protocol is the communication standard used between an application and an Identity Provider. It defines how authentication information is exchanged securely.
What is an Identity Provider (IdP)?
An Identity Provider (IdP) is a system that manages user authentication and login credentials for one or more applications.
Identity Providers allow users to access multiple applications using a single set of credentials.
Does support for SAML mean every Identity Provider will work with OnBoard?
No. While many Identity Providers support SAML, not all providers support every SAML implementation. However, most SAML-compatible Identity Providers can be configured to work with OnBoard.
What is SAML?
SAML (Security Assertion Markup Language) is an industry-standard protocol used to exchange authentication information between an Identity Provider and an application.
OnBoard uses SAML to support Single Sign-On authentication.
Does OnBoard automatically provision user accounts?
No. OnBoard does not currently support automatic user provisioning.
Users must:
- Be created in OnBoard.
- Be created in the Identity Provider.
- Use matching email addresses in both systems.
OnBoard matches the accounts based on email address during sign-in.
Can multiple organizations use the same Sign-On Email Domain?
Yes. Multiple OnBoard organizations can use the same Sign-On Email Domain.
When this occurs, users may see sign-in options for each organization associated with that domain.
How do I know if my Metadata URL is correct?
A valid Metadata URL will display XML configuration data when opened in a web browser.
If the URL displays an error instead of XML data, contact your IT administrator to verify the URL.
Additional Support
How do I get help with SSO setup?
If you need assistance with SSO configuration:
- Submit a request through the OnBoard Support Center.
- Email help@onboardmeetings.com and include "SSO Set Up" in the subject line.
You can also browse additional authentication and security resources in the OnBoard Help Center.
Comments
0 comments
Please sign in to leave a comment.