|
Available on: |
Enterprise plan |
| Required role: | Workspace admin |
Single sign-on (SSO) allow your workspace members to log in via your identity provider (Okta, Microsoft Entra ID/Azure AD or any provider that supports SAML 2.0) instead of personal credentials like passwords or social logins. SSO makes for an easier and more secure way of accessing your workspace.
The process of setting up SAML SSO looks like this:
- Add and verify one or multiple domains
- Configure your identity provider
- Enable SAML SSO in Epidemic Sound
- Decide if you want to require SSO for your members
Step 1: Add a verified domain
You need to have added and verified at least one domain for SSO to be available but you are free to add more. When SSO is configured all users who are 1) members of your workspace and 2) use an email address matching any of your verified domains will be able to log in via your identity provider.
Users who do not use any of your verified domains or who use personal emails, like gmail.com, will not log in with SSO. You can use as many domains with SSO as you want but we only support a single identity provider. A domain can only be registered to a single workspace. If you need assistance then please reach out to customer support or your customer success manager.
On epidemicsound.com, select the menu at the top right corner, choose Organization and then select the Identity & Provisioning tab. Use the Add domain button to start adding your first domain.
Once added you will immediately be prompted to verify your domain.
Completing the verification will require access to your DNS provider. Reach out to your IT-team for help if you lack this access.
Once the verification process is complete your new domain will display as “Verified”.
Step 2: Configure your identity provider
To start the process of configuring SSO, click the button Configure SSO. In the first step that appears you will find some SAML properties that you will need when configuring your identity provider.
We provide dedicated guides for Okta and Microsoft Entra ID (formerly Azure AD) but you can also configure any SAML 2.0 compliant identity provider:
Complete any of the guides above to configure your identity provider. Once complete you will be ready to proceed with enabling SAML SSO for your Epidemic Sound workspace.
Step 3: Enable SAML SSO in Epidemic Sound
To complete the integration you need to connect your identity provider with your Epidemic Sound workspace. Click the Next button on the SAML properties step (Identity & Provisioning → Configure SSO) to get to the Edit SSO configuration step. Here you have two options:
- Enter a metadata URL (recommended): With the metadata URL we can fetch the necessary information for you and renewing the public certificate will be simpler in the future.
- Fill in the information manually: See your identity provider documentation for where to find the Sign on URL, Issuer/Entity ID and Public certificate for your specific identity provider.
Once you’ve reviewed that the information looks correct you can go ahead and Enable SSO. When first enabling SSO it is set up as an optional login method, members can still continue logging in using any login method.
At this stage we strongly recommend that you test logging in via SSO in an “incognito” window before proceeding with requiring SAML SSO to reduce the risk of being locked out. You can use the start URL: https://www.epidemicsound.com/sso/saml/[Tenant ID]/. Tenant ID can be found if you click the Edit configuration button and go back to SAML properties.
We use the user’s email address as the way to identify your users in our system. This means the email address in your identity provider and in our system must match for the user to be able to login.
Step 4: Decide if you want to require SAML SSO on your workspace
It is possible to require your workspace members to only login via SAML SSO. To require SSO on your workspace, toggle the Require SSO option on the Identity & Provisioning tab and select Require in the confirmation modal that appears. Members with email addresses not matching any of your verified domains will still be able to login using any login method.
Before requiring SSO, please ensure that all impacted workspace members have been assigned to the application in your identity provider.
Provisioning
At this point in time we only support manual invites for adding members to your workspace. After enabling SSO all your existing workspace members using a verified email domain can use SSO. All new users will have to login once without SSO in order to accept an invitation but once added SSO will be available.
Common issues and how to solve them
After switching to SSO there are some cases that might prevent your users from being able to login.
"User not assigned to application" when logging in with identity provider
The exact phrasing of this error will differ between identity providers but if your user is seeing issues like "User is not assigned to application"/"error:user_not_assigned", right after logging in at your identity provider then this means the user needs to be granted access by your IT-team.
Error message “Invalid email or password” after logging in with identity provider
Verify that the NameID Format is set to emailAddress. We use email address as the username and therefore need to receive a valid email address as the name-id from your identity provider.
“Your account is not configured to use SSO” on Epidemic Sound login page
This is usually caused by one of the following:
- SSO is not enabled on the workspace
- User is using an email address with a domain that has not been added as a verified domain on the workspace
- The user is not a member of the workspace. If the user received an invitation then the invitation must first be accepted by logging in without SSO the first time.
“User not member of workspace” after logging in with your identity provider
If a user has been assigned the Epidemic Sound app in your identity provider and tries to login via your identity provider using “IdP-initiated” login then it could be that the user either does not exist as a user in Epidemic Sound (has not been created) or has not been added to the workspace via invitation.
If you expect the user to exist but it doesn’t then that could also be because the email address of the user has been changed in your identity provider and no longer matches the email we have. We require that the email address between your identity provider and our system match. See “What to do when a user’s email changes?” below.
What to do when a user’s email changes?
Reach out to customer support or your customer success manager for assistance