The SSO Self-Service feature allows your administrators to independently configure Single Sign-On (SSO) for your organization using popular identity providers such as Okta, Azure, Google, Keycloak, ADFS, and many others. It supports both OIDC and SAML protocols, ensuring compatibility with a wide range of security configurations.
This feature also includes Just-In-Time (JIT) provisioning, which streamlines user onboarding by automatically creating accounts and assigning Reader licenses upon authentication.
This self-service approach eliminates the need for external support, giving your organization greater control and flexibility in managing its security requirements.
When setting up self-service SSO, it is strongly recommended to ask all users to log out and avoid logging in during the entire configuration process. This helps prevent any authentication issues or conflicts.
As the administrator configuring the SSO, do not force your own logout: the system handles it and prompts you to log back in.
Ensure that only one configuration is in progress. Avoid having two or more administrators perform the configuration simultaneously.
Once the setup is complete, you can invite users to log in normally.
Who can use it and where?
This feature is available to all clients who have subscribed to the SSO option. Contact your Account Manager if you want to activate it.
Configuration is done within the Client Space Administration, under the Security section. The user must have Client Space Administrator rights to access this option.
The Security section has two tabs: Security (session expiry) and SSO.
How to configure SSO
- In the Client Space Administration, go to the Security section, open the SSO tab and click Configure SSO.
- Click Next to begin the configuration process.
- Fill in all required fields according to the selected protocol (OIDC or SAML). With OIDC, the form asks for the Client Id, Client Secret, Discovery URL and Login claim type, and lets you enable Just In Time provisioning. For the necessary configuration details, see Set Up SSO in a Dedicated Environment.
- Click Test to verify the configuration.
- If the test is successful, a window opens to confirm that your SSO test has passed. Close it, then click Activate SSO to finalize the configuration.
If the test fails, return to the configuration modal, check all fields, and run the test again.
Once SSO is configured:
- You are automatically redirected to the login page to authenticate again.
- Existing integration tokens and PATs become invalid and must be regenerated.
- Configuration details can be viewed under the SSO tab in the Security section.
How to remove SSO
You can permanently remove SSO if needed. A new configuration will be required to reactivate it.
- Click the Remove button at the bottom right.
- Confirm the removal by clicking Remove again in the pop-up window.Screenshot: removing SSO. (Re-add this image here — the original Freshdesk link expires after a few days.)
Once SSO is removed:
- You are automatically redirected to the login page to authenticate again.
- Existing integration tokens and PATs become invalid and must be regenerated.
How to disable SSO
You can temporarily disable SSO for various reasons, such as performing actions via a support account or running specific tests. This lets you suspend SSO authentication without losing the existing configuration.
- Go to the SSO tab in your interface.
- Toggle the Disabled button on the screen.Screenshot: the Disabled toggle. (Re-add this image here — the original Freshdesk link expires after a few days.)
How to enable SSO
As with disabling, you can reactivate SSO without reconfiguring it. Any previously entered information remains saved.
- Go to the SSO tab in your interface.
- Toggle the Enabled button that appears on the screen.Screenshot: the Enabled toggle. (Re-add this image here — the original Freshdesk link expires after a few days.)