Skip to main content

Single Sign-On

Single sign-on lets people sign in to Amplify through your organization's identity provider, such as Microsoft Entra ID or Okta, using SAML, instead of with a separate Amplify password. Amplify can also create users automatically, the first time they sign in. Single sign-on is set up under the Single Sign-On (SAML) section of Administration > Authentication.

This article covers both the Advanced and Simple Models, and needs administrator access. It also needs someone who can set up Amplify as an application in your identity provider.

How single sign-on works

  • Users sign in through your identity provider — the sign-in page shows a button for it, or skips straight to it.
  • Your identity provider sends their details — at least their email address and name, which Amplify uses to match or create the user.
  • Users created through single sign-on always sign in with it, rather than with a password.

Where single sign-on is turned on, the password policy and two-factor authentication only apply to users who can still sign in with a password. See Authentication.

Details for your identity provider

Your identity provider needs two of Amplify's addresses to set Amplify up as an application. Both are shown in the Single Sign-On (SAML) section:

  • Consumer Service URL — where your identity provider sends users back to after they sign in.
  • Issuer URL — identifies your Amplify to your identity provider.

Your identity provider also needs to send these attributes when a user signs in:

  • email — the user's email address. Required.
  • name, or both givenName and surname — the user's name. Required.
  • amplifyUserType — Guest or Standard. Optional. See Guest Users.

Rolling out single sign-on

Turning on single sign-on changes how everyone signs in, so roll it out in this order:

  1. Set up your identity provider in Amplify, in Test Mode — see Setting up your identity provider.
  2. Test it, while everyone still signs in with their password — see Testing the provider.
  3. Choose how users are created — see Single sign-on settings.
  4. Turn the provider on — see Turning on single sign-on.
  5. Keep password sign-in for at least one administrator — see Keeping an administrator able to sign in.
  6. Once single sign-on is working for everyone, decide whether to skip Amplify's sign-in page — see Single sign-on settings.

Setting up your identity provider

To set up your identity provider in Amplify:

  1. Navigate to Administration > Authentication.
  2. Under Single Sign-On (SAML), click Edit Provider. The Edit Provider form opens.
  3. Enter a name for the provider. It's shown to users on the sign-in page.
  4. Under Provider Information, click Choose Metadata XML File.
  5. Choose your identity provider's metadata file. The provider's settings are filled in, and Metadata XML file successfully parsed is shown.
  6. Set the provider's status to Test Mode.
  7. Save the provider.

Instead of a file, you can paste your identity provider's metadata URL into Enter Metadata URL, and click Go.

To see or enter the provider's settings yourself, turn on Advanced. Its settings are the IDP Entity ID, the Login URL and Logout URL users are sent to, and the SAML Signing Certificate, in X509 format.

Testing the provider

In Test Mode, the provider isn't shown on the sign-in page, so you can check it works before anyone uses it. To test it:

  1. On the Edit Provider form, copy the sign-in link shown above Attributes.
  2. Open a different browser, or a private window.
  3. Paste the link.
  4. Sign in through your identity provider.
  5. Back on the Edit Provider form, check the Validation table. A green tick shows each attribute your identity provider sent correctly.

The form listens for sign-ins while it's open, and shows the attributes your identity provider sent, which helps where a sign-in fails. It also shows whether the IDP Entity ID your identity provider sent matches the one set up in Amplify. To clear the recorded sign-ins, click Delete Sign-in Attempts.

Turning on single sign-on

A provider can only be turned on once it's been tested in Test Mode. To turn it on:

  1. Set the provider's status to Enabled.
  2. Optionally, check Prevent existing users from logging in locally.
  3. Save the provider.

Users now see a button for your identity provider on the sign-in page. To turn single sign-on off again, set the provider's status to Disabled.

Prevent existing users from logging in locally turns off password sign-in for every existing user when you save — including administrators. From then on, they can only sign in through your identity provider. Where your identity provider stops working, no one can sign in until password sign-in is turned back on for someone.

Keeping an administrator able to sign in

Where you've prevented password sign-in, turn it back on for at least one administrator, so they can still sign in if your identity provider is unavailable. To turn it on:

  1. Navigate to Administration > Manage Users.
  2. Click the administrator's name.
  3. Click Edit. The Edit Amplify Account page opens.
  4. Turn on Allow log in via Amplify when SAML is enabled.
  5. Click Update.

The administrator's page shows the setting as enabled. Make sure they use two-factor authentication — see Two-Factor Authentication.

Single sign-on settings

These settings, in the Single Sign-On (SAML) section, apply to everyone who signs in through your identity provider. Click Update SAML Settings after changing them.

  • Create user if the user does not exist — creates an Amplify user the first time someone signs in. Leave it on to let anyone your identity provider allows into Amplify. Turn it off to only let in users who've already been created or imported in Amplify; anyone else can't sign in until they're created.
  • Auto-create guest users via the Initiative Submission URL — creates people who start from the Initiative Submissions link as guest users, so they can submit initiatives without being given access to the rest of Amplify. It only applies where Create user if the user does not exist is turned off. See Guest Users.
  • Update the name of the user after a successful login — keeps each user's name in Amplify in step with your identity provider.
  • Bypass the login screen by redirecting automatically to the identity provider — sends users straight to your identity provider, without showing Amplify's sign-in page. Turn it on once single sign-on is working for everyone.

Deleting a provider

An enabled provider can't be deleted. To delete one, first set its status to Disabled, and save it. A provider in Test Mode, or disabled, can be deleted straight away.

For the other ways users sign in, see Authentication.