Single Sign-On (SSO) is an alternative to using the native piplanning.io Username + Password credentials for user authentication. piplanning.io supports the following protocols for SSO:
OIDC: Open ID Connect
SAML: Security Assertion Markup Language
Enabling Single Sign-On
Navigate to: RTE Cockpit > SSO
Select the button for the corresponding protocol you wish to configure:
For SAML - please activate SSO and then contact us (via the In-App Messenger or via [email protected]) to finalize the setup.
For OIDC - please follow the instructions related to your Identify Provider (IdP) in the linked Help Articles below.
ℹ️
SSO is available on the Premium or Enterprise pricing plans.
Please contact us by either using the chat/messenger bot or emailing us at [email protected] if you wish to have SSO enabled.
Enforcing Strict SSO - SSO Authentication Only
To strictly use SSO only for User authentication, and prevent Users from using their native piplanning.io credentials; simply check the checkbox:
☑️ Enforce SSO-only login at the bottom of the SSO page.
IMPORTANT: You can potentially lock yourself out of piplanning.io. After this setting is enabled, if SSO is not responding no user will be able to login. If you get to this point where you are not able to login to the RTE Cockpit > SSO page and revert this setting the please do either of the following:
piplanning.io Cloud customers can contact us to assist with restoring access.
piplanning.io On-premise customers, you need to follow custom instructions to gain access to piplanning.io by authenticating with the SSO/IdP.
In either case, please reach out to us over via the Chat/Messenger bot or by emailing [email protected].
Creating New Users when Strict SSO is enforced
Note: with SSO-only enabled, the User authentication tasks will now be performed by the Identity Provider (IdP) that is connected.
This authentication step must also now happen when onboarding (creating) new Users in the piplanning.io app.
Below is information to help you manage new User onboarding when SSO is enabled:
NOTE: When strict SSO is enforced the +Create [User] button will disappear from the RTE Cockpit > Users page.
With Strict SSO in place, you can onboard new Users in 2x ways:
Method 1: Invite them to be a member of a Team by editing the Team and adding their email address to the Add members > Invite new field on the Team page. An outline of the steps involved in this workflow, and how the User will be engaged are outline in this Help Article: User Onboarding.
Method 2: Sharing the direct link to your organizations piplanning.io instance which is available on the Users page. See screenshot below.
Share the direct URL from the RTE Cockpit > Users page with new Users.
Ask them to click the link and sign in to piplanning.io via SSO.
Once they are successfully authenticated via SSO, then their new User account will be created in piplanning.io.
Remember at this stage, an Admin or PI Admin still must add that new User into a Team or grant them a new Role such as PI Admin (ART Admin etc.)
2.