Skip to main content

Single Sign-On (SSO)

Log in easily using your SSO provider.

Set up SSO (Single Sign-On) via Google, Microsoft (ActiveDirectory, Entra ID), or a provider that supports SAML.

SSO provides an additional layer of security to your account, and your users won't have to remember another login. You can also use SSO with the Perdoo app for iOS or Android.

šŸ’” Pro tip: You can add 2FA (two-factor or multi-factor authentication) through our Single Sign-On (SSO) integration. Most SSO providers (Microsoft Azure, SAML, Google, etc.) allow you to enforce 2FA. Once this is enforced, 2FA will also be a requirement to log in to Perdoo.
ā€‹


How to set up SSO

ā„¹ļø This requires Superadmin rights.

Enabled

Check (to enable SSO) or uncheck (to disable SSO) the checkbox.

Company domain(s)

Enter your company domain here. For multiple, separate your domains with a comma:

Multiple company domains listed

User provisioning

These settings control what happens if a user logs in via SSO that hasn't been created in Perdoo yet.

When enabled, it'll create a new standard user with the same email address. When disabled, the user will not be able to log in.

The fields that will populate automatically are first_name , last_name, and job_position.

Strict authentication

For added security, enforce SSO-only logins, by checking the checkbox. This prevents any user from logging in via email password, or performing a password reset.

Provider

Choose Google or a SAML (ADFS, OneLogin, Bitium, Okta, etc.) connection.

SAML

ā„¹ļø Available on Premium and Supreme.

In Configure > SSO, make sure that the box for Enabled is checked and the Provider is set to SAML:

The following SAML attributes are supported:

Name

Value

First name

user.first_name

Last name

user.last_name

Job position

user.job_position

More attributes are supported when you use our SCIM integration.

From your identity provider:

  • Entity ID (aka. Metadata URL)

  • SSO URL (aka. SAML Sign In URL)

  • SLO URL

Copy the following to your identity provider:

  • ACS URL

  • Entity ID
    ā€‹

If you're seeing a "Server Error (500)" message while trying to log in, consider the following:

  • Check the email address for typos. In that case, SSO (SAML) authentication will fail.

  • The email address could already be used for another Perdoo account.

  • Make sure you've been added to your organization's account. Please contact the admin of your account regarding this.

  • Check in with your ID provider to make sure your user information is accurately stored in the IDP.
    ā€‹

Microsoft ActiveDirectory / Entra ID

ā„¹ļø Available on Premium and Supreme.

  1. In Configure > SSO, make sure that the box for Enabled is checked and the Provider is set to SAML:

  2. Go to https://portal.azure.com
    ā€‹

  3. From All services, search and select Enterprise applications service.

  4. Click New application

  5. Click Create your own application.

  6. Give it a name and click Create.

  7. Once itā€™s been created, go to Single Sign On and select SAML.

  8. Under Identifier (Entity ID), add the generic metadata url https://api-

    eu.perdoo.com/metadata/).
    ā€‹

  9. Under Reply URL (Assertion Consumer Service URL) add the Service Provider ACS URL from Perdoo and hit Save.

  10. Copy the Login URL into the SSO URL field in Perdoo.

  11. Copy the Azure AD Identifier into the Perdoo Entity ID field.

  12. From the Azure navigation menu on the left, go to User Attributes & Claims, set user.mail as Name identifier value > Source attribute. Keep any default attributes:

  13. Download the SAML Signing Certificate (Base64), and open it in a text editor. Then copy it into the IdP Certificate field in Perdoo.
    ā€‹

  14. Finally, test the connection. Youā€™ll need to add some users or groups under Users and groups first.


FAQs

What happens when a userā€™s details are updated, for example job title or email? Would it automatically update in Perdoo?

  • No, it currently only copies it over upon creation. All fields, including email, are only copied over when the user is created and not on every login.

  • With our SCIM integration details like these are automatically synced.

Is it possible to auto-populate Manager and Groups from our Azure?

  • Yes, this is possible with SCIM.

Why do I get the error AADSTS50105 when trying to login via SSO with Azure AD?

Sorry, but weā€™re having trouble with signing you in.

AADSTS50105: Your administrator has configured the application Perdoo (SSO) to block users unless they are specifically granted ('assigned') access to the application. The signed in user is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.

  • If you receive the above error message when trying to log in to Perdoo via SSO/SAML, your Azure administrator needs to add you to the correct group so you are able to access Perdoo again.

    • Here are the steps for your Azure administrator:

      • Navigate to https://portal.azure.com/

      • Search for Azure Active Directory

      • Click Enterprise applications

      • Search for Perdoo

      • Click + Add user/group

      • Select the user who needs access to the app

      You can find more information from Microsoft here.


Need a hand?

Contact our friendly Support team via the in-app chat at the bottom-right of your screen, or email support@perdoo.com.

Related Articles
Did this answer your question?