Skip to main content
Single sign-on lets your users log in to Reelevant with the account they already use at work. Your identity provider is the tool your company uses to manage staff accounts, such as Okta, Microsoft Entra ID, or Google Workspace. You configure it yourself from the account administration section. Nobody at Reelevant needs to do it for you.

​
What It Does For You

  • People log in through your identity provider instead of a Reelevant password.
  • You keep control of who can log in, from one place.
  • You can create Reelevant accounts automatically on first login, so nobody has to be invited by hand.
  • You can make single sign-on the only way in, once you are confident it works.
Single sign-on decides how people log in. It does not create or remove accounts on its own the way automatic provisioning does. The two are configured separately, and they work well together.

​
Before You Begin

  • You need permission to update company settings in Reelevant.
  • You need an administrator account in your identity provider.
  • Export the metadata of your identity provider. It is a file, or a page of text starting with <EntityDescriptor.
  • List the email domains your staff use, such as acme.com.
  • Create the roles and Teams that new people should get.

​
Setting It Up

The setup goes both ways: you describe your identity provider to Reelevant, then you declare Reelevant in your identity provider.
1

Open the single sign-on settings

Go to the account administration section and open Single sign-on.
2

Add your email domains

Fill in Email domains. Anyone whose email address ends with one of these domains is sent to your identity provider to log in.
A domain can only be claimed by one company. If it is already used elsewhere, saving is refused and you are told so.
3

Paste the metadata of your identity provider

Paste the exported text into Identity provider metadata (XML). Reelevant checks it before saving and tells you if it cannot be used.
4

Choose how accounts are created

Pick a User provisioning option:
5

Check the attribute mapping

Attribute mapping tells Reelevant where to read each piece of information your identity provider sends. A mapping for email is always required. Add a line per extra property, such as the first name or the last name.
Each line is written the way the value is nested in the message from your identity provider, with a dot between levels: attributes.email.
6

Save the configuration

Click Save configuration. Reelevant then generates a signing certificate for your company, on its own.
7

Declare Reelevant in your identity provider

The section What to declare in your identity provider lists the values to copy across. Each one has a copy button.
8

Test a login

Open a Login URL in a private browser window and log in with your own account. The audit log records the attempt, accepted or refused, with the reason.

​
Making Single Sign-On Mandatory

By default single sign-on is optional: people can still log in with their Reelevant password. Turn on Require single sign-on to refuse every other way in for your domains. The toggle stays unavailable until one login through your identity provider has succeeded. That is deliberate: it makes it impossible to lock your whole company out with a wrong setting.
Changing the metadata or the domains of a working configuration makes the toggle unavailable again, until a login proves the new setting works.

​
Renewing The Signing Certificate

Use Rotate certificate when your security policy asks for a new certificate, or if you believe the current one is compromised.
Logins fail until the new certificate is declared in your identity provider. Plan the change, and copy the new value across straight away.

​
Turning Single Sign-On Off

Turn Require single sign-on off first, so people can log in with their password again. Delete configuration is only offered once enforcement is off. Deleting removes the configuration, the certificate, and the redirection of your domains. Users, roles and Teams are untouched.

​
If Something Does Not Work

​
What’s Next?

Automatic provisioning (SCIM)

Let your identity provider create and remove accounts too.

Audit log

Read every login attempt and its outcome.

Users

Check who has access, and their login URL.

Roles

Decide what people can do once they are in.