Single Sign-On (SSO) lets your team sign in to Digital Showroom with their corporate credentials, so they have one less password to remember and you control access from your identity provider. Users are created automatically at their first SSO sign-in, and SSO group mapping can place them in the right User Groups. You set up SSO yourself, without contacting Akeneo.
You need the Administrator role to set up SSO, and the help of the person who manages your identity provider and your company's DNS records.
SSO is for Digital Showroom users only. Guests invited to a Private Showroom never use SSO: they sign in with a one-time code sent by email.
How SSO setup works
- You create an SSO connection in Digital Showroom. This generates a configuration link.
- Your identity provider administrator opens the link and follows the configuration wizard: they connect your identity provider (with SAML or OpenID Connect) and verify your company's email domain.
- The connection is activated, and your users can sign in with SSO.
- You map your identity provider's groups to Digital Showroom User Groups. See Set up SSO group mapping.
Your organization can have one SSO connection. Both SAML and OpenID Connect (OIDC) identity providers are supported.
Create the SSO connection
- Go to Admin > User management > Single Sign-On.
- Click New SSO connection. The Configuration URL appears, with how long the link is still available.
- Click the copy icon to copy the link, or the open icon to open it in a new tab.
- Send the link to your identity provider administrator.
The link is valid for 48 hours. The page checks the status of the connection automatically and shows it as configured as soon as the wizard is completed.
While a link is pending, you cannot create another SSO connection, and you cannot cancel the link from the page. If the link expires before the wizard is completed, click New SSO connection again to get a new one.
Complete the configuration wizard
Your identity provider administrator follows the wizard behind the link. Along the way, they must:
- Choose your identity provider and enter its connection details.
- Add your company's email domain, for example yourcompany.com.
- Verify the domain by creating the DNS TXT record shown in the wizard.
The connection cannot be activated until the domain is verified. Once it is, users who enter a work email address on that domain on the Digital Showroom login page are sent to your identity provider automatically.
After the connection is activated
The SSO connections table shows your connection with its Display Name, creation dates, and the Activated status.
- Users sign in from the Digital Showroom login page with the SSO button or their work email address. See Log in to Digital Showroom.
- You do not need to invite SSO users. A user account is created at their first SSO sign-in, with the User role. You can change their role in Admin > User management.
- If someone already had a Digital Showroom account with the same email address, their SSO account keeps the role of that account, and replaces it.
Update an activated connection
To change the identity provider settings of an active connection, for example after a signing certificate renewal, generate an edit link.
- Go to Admin > User management > Single Sign-On.
- In the SSO connections table, click the actions menu (three dots) on the connection.
- Click Edit configuration. The Update SSO configuration dialog opens with a new configuration link, valid for 48 hours.
- Copy the link and send it to your identity provider administrator, or click Open configuration.
Users keep signing in normally while the link is open. The connection keeps its name and its verified email domain, which the edit wizard cannot change. The wizard also cannot switch a connection between SAML and OpenID Connect: to change protocol or email domain, contact Akeneo Support.
Always use Edit configuration to reconfigure SSO. Replacing the connection with a new one releases the verified domain and gives every SSO user a new identity, which creates duplicate users.
Map identity provider groups to User Groups
With SSO group mapping, SSO users are placed in the right User Groups automatically, based on their groups in your identity provider. The SSO group mapping switch on the Single Sign-On page is on by default. To configure your identity provider and your mappings, see Set up SSO group mapping.
To change the switch, click it, then click Save at the bottom of the page and confirm.
- Turning mapping off deletes all your SSO group mappings. SSO users keep their current User Groups, which you can then edit manually like any other user. The mapping section is hidden.
- Turning mapping on removes SSO users from all the User Groups you assigned manually. They get their groups back from your mappings when you save mappings that match their groups, or at their next SSO sign-in.