Enterprise Single Sign-On (SSO) enables users in your organization to securely access VALD applications using your organization's existing login system.
Once configured, your IT administrator can enforce security policies and centrally manage authentication for your users via your designated Identity Provider.
For a user, this looks like signing in with their work email, then being redirected to your organization's login page before being returned to VALD.
Getting started with Enterprise SSO
To enable Enterprise SSO for your organization, the first step is to discuss your requirements with VALD. Reach out to your VALD Business Development Manager (BDM) who can advise on how this might look in your specific case, including technical and commercial considerations.
At this stage, you will be able to provide contact information for a technical member of your team who can assist with configuring Enterprise SSO.
Your details will then be passed to our team who will get in touch with you and your nominated technical contact to guide you through the setup process below.
Supported Enterprise Identity Providers
- Microsoft Azure AD (Microsoft Entra ID)
- Microsoft ADFS
- Google Workspace
- OpenID Connect (OIDC)
- SAML
- Ping Federate
How to enable Enterprise SSO
Before you begin
- Ensure that VALD's network requirements are allowed by your firewall and security tools.
- Have your Identity Provider open in a separate browser tab or window so you can easily access and edit information as needed.
Configure SSO using VALD SSO Setup Assistant
- Open the link to the Setup Assistant provided by Support and follow the instructions to complete your configuration.
Note: The link will expire within 5 days, and within 5 hours once opened. Contact us if a new link is required.
Verify the setup
- Open a private browser window and run an SSO readiness check.
- Confirm that you are being redirected as expected to your Identity Provider for authentication.
- Confirm the Display Name and Email attributes are correctly displayed.
Test with users
- Repeat the steps described above with several VALD users on at least one desktop and one mobile device. Take note of the email addresses of users involved with testing.
Notify VALD
- Let our Support team know whether the testing was successful and include the emails of users involved with testing.
- Advise on your desired go-live date for Enterprise SSO to be activated across your organization.
What to expect after enabling Enterprise SSO
Upon logging for the first time with SSO, existing VALD users will be prompted to 'Link your Accounts'. This will allow them to link their current username-password account to their new SSO account, retaining their existing access and settings. To complete this process users need to provide their current VALD credentials.
Existing VALD users who are already authenticated at the time of launch will not be automatically logged out to minimize disruptions. However, it is recommended that they log out and back in as soon as possible to avoid having to complete the account linking process at a potentially inconvenient time.
Troubleshooting and FAQ
Can I register multiple email domains for Enterprise SSO?
Yes, you can nominate multiple domains as long as they are all managed by your Identity Provider.
What if I need to update my Enterprise SSO post-launch?
You can update your Enterprise SSO connection by contacting support@vald.com who will issue a new SSO Setup Assistant link. For instance, this can be used when the signing certificate needs to be updated.
How do I invite users and set permissions with Enterprise SSO?
The processes to add new users and configure user permissions in your VALD organization does not change once you enable Enterprise SSO. Refer to our Knowledge Base guides on adding users and setting up permissions.
If you have sent an invitation to a new user and they are yet to activate their user account (or misplaced their activation email), you can resend the invitation.
- In VALD Hub, navigate to Management > User Access and enter the Invitations tab.
- Locate the user and click the three dots next to their name, selecting Resend Invite Email.
Can users sign up for MoveHealth with Enterprise SSO?
The MoveHealth functions and features are already available natively within VALD Hub. If a user attempts to sign up for a new MoveHealth-only organization using an email domain registered for Enterprise SSO, the organization will not be created.
This is to ensure all user accounts and organizations are centrally managed by your Identity Provider.
They will instead receive an email instructing them to contact the VALD Support team at support@vald.com.
Can I use email aliases to create new users?
Due to the functions and limitations of Enterprise SSO, email aliases (e.g. "username+alias@domain.com") cannot be used.
Comments
0 comments
Please sign in to leave a comment.