Demandbase Support-Assisted Setup for Single Sign-On (SSO)

Single Sign-On (SSO) allows users to sign in to Demandbase One using your organization's identity provider (IdP), such as Okta or Google.

You can configure SSO directly in Demandbase One or with assistance from Demandbase Support. This article explains how to set up SSO with Demandbase Support.

SSO is optional. Once enabled, SSO becomes the exclusive authentication method for your organization. To re-enable other sign-in methods, contact Demandbase Support. See Understanding and Troubleshooting Demandbase One Log In.

Demandbase supports the following SSO protocols:

• OpenID
• SAML 2.0

Prerequisites to Set Up SSO with Demandbase Support

• You have administrative access to configure applications in your identity provider.
• Your identity provider supports configuring a Relay State URL.
• You can provide your identity provider's configuration details to Demandbase Support.

Set Up SSO with Demandbase Support

To configure SSO, complete the following steps with Demandbase Support.

1. Create an application in your identity provider.
2. Provide the following information to Demandbase Support:
   • IdP Issuer URI: Unique identifier for your identity provider.
   • IdP Single Sign-On URL: URL used to authenticate users through your identity provider.
   • IdP Signature Certificate: Certificate used to verify authentication responses.
   • Email domain: Your organization's email domain (for example, @demandbase.com).
3. Demandbase Support configures the identity provider and routing rules, then provides the following information:
   • Assertion Consumer Service (ACS) URL
   • Audience URI
   • Relay State URL
4. In your identity provider, open the application you created and enter the configuration details provided by Demandbase Support.

Test the SSO Connection

After completing the configuration, test the SSO connection before deploying it to all users.

1. Contact Demandbase Support to enable SSO for a test user or your entire organization.
2. Test the connection using both methods:
   1. IdP-initiated login: Open Demandbase One from your identity provider's application dashboard.
   2. Service provider-initiated login: Sign out of your identity provider and navigate to web.demandbase.com to sign in.
3. Confirm that both methods successfully authenticate users and provide access to Demandbase One.

Deploy SSO to Users

1. After successfully testing the connection, complete the following steps:

2. Notify users that they must sign in to Demandbase One using SSO.
3. Create user profiles for users who need access to Demandbase One.
   Important: Demandbase does not support Just-In-Time (JIT) provisioning. Users must have a Demandbase One user profile before signing in through SSO.
4. (Optional) Add a Demandbase icon to the application tile in your identity provider.

Troubleshoot SSO Login Issues

If a user cannot sign in through SSO, verify the following:

• Login method: The user is signing in through the identity provider's application tile or web.demandbase.com.
• User profile: The user has an active Demandbase One user profile.
• Email domain: The user's email domain matches the domain configured for SSO.

To configure an exception to your organization's SSO rules, such as allowing a contractor with a different email domain to sign in, contact Demandbase Support.