Set Up Single Sign-On (SSO)

  • Updated

Context

Users can sign in to Demandbase One using your company’s Single Sign-On (SSO) system, such as Okta or Google. Setting up SSO for login is optional. If you enable SSO for your users, all other sign-in methods are disabled unless the Demandbase Support team provides assistance. See Understanding and Troubleshooting Demandbase One Log In.

Demandbase supports the following SSO protocols:

  • OpenID
  • SAML 2.0

Important: To set up Google SSO, contact Demandbase Support.

Prerequisites/Preparation

You must be able to input a Relay State URL (usually only a challenge for homegrown solutions).

Steps: Setup

  1. Create a stub application in the SSO provider system.
  2. Provide the following information to your Implementation team:
    • IdP Issuer URI
    • IdP Single Sign-On URL
    • IdP Signature Certificate
    • Email domain (e.g., @demandbase.com or @an.demandbase.com)
  3. The Demandbase team creates a corresponding Identity Provider and Routing Rules, then shares the following information back with you:
    • Assertion Consumer Service URL
    • Audience URI
    • Relay State URL
  4. Go to the stub application you’ve created in your SSO provider and enter the information provided by Demandbase.

Steps: Testing

  1. Confirm the setup steps are complete and ask Demandbase to enable the connector; either for a specific individual conducting the testing, or for the whole team.
  2. Test the connection in two ways:

Steps: Deployment

  1. Inform your team that their login process has changed, and they must sign in using SSO.
  2. Create user profiles in Demandbase.
    Important: Demandbase does not support Just-In-Time Provisioning. For new users, create the user in Demandbase One first.
  3. (Optional) If you’re using a system such as OKTA, you can include a Demandbase image file for the tile.

Troubleshooting

If a user is unable to sign in with SSO, check the following:

  • User is signing in from the SSO tile, or from the correct web site: https://web.demandbase.com
  • User has a Demandbase user profile.
  • If you want to create an exception to your tenant-level rule (for example, a contractor with a different email domain), contact Demandbase Support.

Was this article helpful?

6 out of 8 found this helpful