Activation process SSO Introduction
Linking to SSO is done based on the OpenID connect (OIDC) protocol. The configuration of SSO requires three keys which we can use to link. These keys are generated in the client's user management environment (Azure, Google, etc.) to which SSO will be linked. With these keys, Signhost can configure an SSO redirect URL:
Signhost delivers a Redirect URL in the following format:
https://account.evidos.com/signin-###This Redirect URL can be configured in the client's management environment.
Signhost then creates a RegisterURL (activation link) to link accounts:
https://account.evidos.com/manage/openid/external?provider=###Finally, Signhost creates a loginURL for users to log in to. Logging in must always be done via this link: https://account.evidos.com/account/ExternalLogin?provider=###
The characters in the link ### are replaced by a unique identifier for the client.
Activation process
The customer creates an OpenID Connect SSO link.
Signhost discusses with the client whether SSO will be enforced for all users.
The customer shares the following to Signhost :
o ClientID,o ClientSecret,
o Discover URL (endpoint URL)
Note: Signhost uses secure communication through the mSafe tool and creates an environment for the client in consultation
Signhost shares the RedirectURL with the client via mSafe
The customer configures the redirect URL.
Signhost shares the ManageURL and the LoginURL with the customer via mSafe
The customer logs in to the Signhost portal with the portal administrator user.
Portal administrator opens the RegisterURL in a new tab. Logging into SSO connects this account to the Signhost portal account which the user has logged into in the other tab.
Portal administrator confirms they can log in to the Signhost portal using the LoginURL Signhost provided.
If there are multiple active users, they should all first follow the steps above. The portal administrator will provide the RegisterURL and LoginURL to all other users.
The client confirms to Signhost that all users can log in using the LoginURL with SSO.
Unless agreed otherwise at step 2: Signhost closes the option to use username and password to login.
➡️ Depending on the agreements made at step 2, proceed with the appropriate step-by-step process for adding new users.
Option 1: Add new users - SSO is enforced:
After SSO activation, the portal administrator can add new users via the user management in the Signhost portal. This is done through the following steps:
Portal administrator logs in to the Signhost portal and navigates to the user management page to add a new user.
Portal administrator provides LoginURL to the new user.
Signhost sends an automatic email to activate the new user account. Can't find this email? Then search for noreply@signhost.com.
The user follows the link in the email (the link can only be used once)
The user will be redirected to the login page of your organization. Log in with your standard organization login details.
SSO is now linked to the new user.
The user can log in using the LoginURL the portal administrator provides: https://account.evidos.com/account/ExternalLogin?provider=########
Option 2: Add new users - login is also possible with username + password
After SSO activation, the portal administrator can add new users via the user management in the Signhost portal. These users can activate their accounts and set up SSO. This is done through the following steps:
Portal administrator logs in to the Signhost portal and navigates to the user management page to add a new user.
Portal administrator provides RegisterURL and LoginURL to the new user.
Signhost sends an automatic email to activate the new user account. Can't find this email? Then search for noreply@signhost.com.
The user follows the link in the email (the link can only be used once)
The user sets up their account with a username and password.
The user opens the RegisterURL in a new tab. Logging into SSO connects this account to the Signhost portal account which the user has logged into in the other tab.
The user account is linked to the Signhost portal.
The user can log in using the LoginURL the portal administrator provides: https://account.evidos.com/account/ExternalLogin?provider=########
💡 Note:
You can check if an account is linked to the SSO provider here: https://account.evidos.com/Manage/openid.
No provider listed here means that no link has been made.