Skip to content

Single sign-on

With single sign-on (SSO), your users sign in to MiaRec with your organization's identity provider — for example Google, Microsoft, Okta, or another SAML 2.0 provider — instead of a separate MiaRec password. Users get one less password to manage, and your identity provider's security policies (MFA, conditional access, offboarding) automatically apply to MiaRec sign-ins.

What users see at sign-in is described in Signing in in the User Guide.

How SAML sign-in works

SAML 2.0 is a standard protocol that lets an identity provider (IdP) tell a service provider — MiaRec — who a user is, by sending a cryptographically signed assertion of the user's identity. Once configured:

  1. The user opens your MiaRec portal URL.
  2. The sign-in page offers a Sign in with ... option for your identity provider.
  3. The user's browser is redirected to the identity provider, which authenticates the user (or recognizes an existing session).
  4. The browser returns to MiaRec with a signed SAML assertion.
  5. MiaRec verifies the assertion, matches the identity to a user account, and signs the user in.

Managed by your service provider

Registering a SAML 2.0 identity provider — the IdP metadata, certificates, and attribute mapping — is done at the platform level by your service provider. Contact them to connect your identity provider.

In addition to SAML, SSO integrations with Google, Microsoft, and Webex can be connected from the Administration › System › Integrations catalog — see Integrations.

Enabling SSO for your organization

Your organization's SSO policy lives in the Single Sign-On section of Administration › User Authentication › Password Policy:

  • Enabled — users can sign in with SSO or with their MiaRec password, depending on their account's authentication type.
  • Disabled — SSO sign-ins are rejected for your organization.

  • Mandatory — users must sign in with SSO; password sign-in is refused.

  • Restricted domains — optionally limit SSO sign-ins to specific email domains: users whose email domain is not listed cannot sign in with SSO.

Each user account also has an Authentication type — password or Single Sign-On — on the user form (see User accounts).

Warning

Before setting SSO to Mandatory, make sure your administrators can sign in through the identity provider — password sign-in will no longer be accepted for your organization's users.

Account linking

MiaRec links identity-provider identities to user accounts:

  • On a user's first SSO sign-in, MiaRec matches the identity to a user account by its verified email address and links them. Subsequent sign-ins use the established link.
  • If several accounts share the email address, the user is asked to choose which account to sign in to.
  • If the identity is already linked to a different account than the email suggests, the sign-in is rejected — the setup must be corrected by an administrator.

Linked accounts are visible in two places: on the Security tab of the user's profile in Administration (User accounts), and to the user themselves in My Profile › Security (Account security).

SSO and two-step verification

If your organization requires two-step verification, you can exempt SSO users from it (the Required for non-SSO users option) — useful when your identity provider already enforces its own MFA.