SSO, also known as Single Sign-On, streamlines the authentication process for users by allowing them to access multiple applications or services with just one set of login credentials. This eliminates the hassle of remembering and managing multiple login details for different systems. With SSO, once a user has successfully logged in to one application or service, they are automatically granted access to other connected systems without the need to log in again. This seamless access is made possible by exchanging authentication tokens or credentials between the various systems, which is often facilitated by a central identity provider.
To enable SSO, you need to open Organization → Security → Settings.
Click “Add Domain” in the Security section and enter one or several domains.
Each domain requires a Verification and will expire in 14 days otherwise.
You may add more than one domain, yet each must be verified separately. Domains with pending verification cannot use SSO.
Click “DNS” to get the required information to put in your DNS provider records and copy the value from the “Name” line.
Note: The next section requires access to the DNS provider record. Contact your Administrator of DevOps in case you are having trouble with the following section.
For instance, you have Cloudflare. Go to /dns/records and paste the value
Click “Add record” and after that, click “Edit” and copy and paste the “Value” into the “Target” field.
Save changes, go back to your organization settings, and click “Check Verification”.
SAML Settings
After the domain is verified, SAML Settings need to be configured. These settings are located below Domain Settings on the same page. Here is an example of configuration via Microsoft Azure. First, you need to create an application in Azure.
Log in to Microsoft Azure and start the process of creating of Enterprise application.
On the application type selection page, choose Create your own application.
Enter the application name and select Integrate any other application you don't find in the gallery (Non-gallery)
Choose Set up single sign-on.
And then SAML.
Basic SAML Configuration
Start to edit Basic SAML Configuration in your Azure application. You need to create SAML Settings in DocHub, select Azure, then copy Identifier (Entity ID), Reply URL, Relay State values from DocHub and insert them into Basic SAML Configuration in Azure in the same fields.
DocHub settings:
Basic SAML Configuration in edit of Azure application:
Attributes & Claims
Save and close the previous form. Then, start editing the Attributes & Claims section.
Change Unique User Identifier (Name ID)to have user.email value instead of the default user.userprincipalname
SAML certificate and provider settings
Download Certificate (Base64)
Open the downloaded file in any text editor, copy the content, and insert it into the Certificate (Base64) field in DocHub.
Copy the Login URL and Microsoft Entra Identifier values from Azure.
Insert them into the Login URL or User access URL and Azure AD Identifier fields in DocHub. Save changes in Dochub. After that, you may sign in or sign up for DocHub via SSO with your Azure application.