Context
Users can sign in to Demandbase One using your company’s Single Sign-On (SSO) system, such as Okta or Google. Setting up SSO for login is optional. If you enable SSO for your users, all other sign-in methods are disabled unless the Demandbase Support team provides assistance. See Understanding and Troubleshooting Demandbase One Log In.
Demandbase supports the following SSO protocols:
- OpenID
- SAML 2.0
Important: To set up Google SSO, contact Demandbase Support.
Prerequisites/Preparation
You must be able to input a Relay State URL (usually only a challenge for homegrown solutions).
Steps: Setup
- Create a stub application in the SSO provider system.
-
Provide the following information to your Implementation team:
- IdP Issuer URI
- IdP Single Sign-On URL
- IdP Signature Certificate
- Email domain (e.g., @demandbase.com or @an.demandbase.com)
-
The Demandbase team creates a corresponding Identity Provider and Routing Rules, then shares the following information back with you:
- Assertion Consumer Service URL
- Audience URI
- Relay State URL
- Go to the stub application you’ve created in your SSO provider and enter the information provided by Demandbase.
Steps: Testing
- Confirm the setup steps are complete and ask Demandbase to enable the connector; either for a specific individual conducting the testing, or for the whole team.
-
Test the connection in two ways:
- Navigate to the Demandbase Platform from your SSO homepage.
- Log out of SSO and navigate to https://web.demandbase.com.
Steps: Deployment
- Inform your team that their login process has changed, and they must sign in using SSO.
-
Create user profiles in Demandbase.
Important: Demandbase does not support Just-In-Time Provisioning. For new users, create the user in Demandbase One first. - (Optional) If you’re using a system such as OKTA, you can include a Demandbase image file for the tile.
Troubleshooting
If a user is unable to sign in with SSO, check the following:
- User is signing in from the SSO tile, or from the correct web site: https://web.demandbase.com
- User has a Demandbase user profile.
- If you want to create an exception to your tenant-level rule (for example, a contractor with a different email domain), contact Demandbase Support.