What is single sign-on (SSO)?
Logging in using single sign-on (SSO) allows an employee to use a single username and password to access all of the company’s services (including tipee). This makes access control easier and strengthens security: only one account to secure with a strong password, generally supplemented by a second factor of authentication.
How does it work ?
The SAML (Security Assertion Markup Language) standard is used and allows the following sequence:
The user authenticates with an identity provider (IdP) compatible with the SAML 2.0 standard (such as Google, Microsoft Entra ID, Okta, or many other solutions).
The identity provider generates and sends an unalterable document, called the SAML Response, certifying that the user [email protected] has successfully authenticated.
This SAML response is then transmitted to tipee, which uses this proof to log in the user [email protected].
Configure the connection via single sign-on (SSO)
The setup of the single sign-on (SSO) connection on tipee takes place in several steps.
First, contact support via the messenger of your tipee to enable this login method on your instance.
Provide the identity provider with the information shown on tipee’s SAML configuration page. This information is automatically adapted to your instance. You can access it in the tipee configuration by clicking the first letter of your last name (or your profile picture) in the menu bar on the left side of the screen, then clicking Configure. Then go to the SAML login section.
The table titled Information for the identity provider contains all the data necessary for configuration.
Next, fill in the fields on that same page with the information provided by your identity provider. If the IdP provides you with an XML file, you can also import it directly into tipee.
⚠️If the XML file contains too much information, tipee might not be able to automatically determine which data to use. In this case, manually enter the information into the designated fields.
Make sure that the IdP actually returns an email address when authenticating the user. Here is how tipee extracts this email address in the SAML response:
tipee first checks whether the <NameID> (present in the <Subject>) is an email address. If so, it uses that value.
If not, tipee looks for an attribute named email and uses its value if available.
This email address is then used to find the tipee user.
⚠️The email addresses provided in the personal or professional email fields are not suitable because there is no verification that they are unique, unlike the username field.
It may therefore be necessary to modify your teams’ usernames if the email address is not systematically used as a username.
Single sign-on does not remove the existing password. To prevent a user from logging in with a password, you must remove it. To do so, go to the employee’s profile, then open the Account tab.
💡Too many employees to make these changes manually?
Contact tipee support via the messenger of your tipee to get assistance with modifying, forcibly updating usernames, or removing passwords.
SSO and strong authentication in tipee
It is important to reconsider, if necessary, how tipee’s two-factor authentication (2FA) works.
Several scenarios can make 2FA redundant or unnecessary:
If the IdP in use provides a level of security perceived as higher than that of the tipee password.
If the IdP already includes a second factor of authentication.
To remove tipee’s 2FA, simply remove the date Start date of the double factor obligation found under your profile > Configure > Security > Two-factor authentication.
💡It may be wise to temporarily or permanently keep tipee’s 2FA for users who do not yet use only SAML and still have a tipee password.
Bonus: Automatically select the professional Google account
If you use Google as your identity provider, the fact that some employees have both a personal Google account and a professional account on their machine can be inconvenient, as they frequently have to select the correct one when logging in. In that case, you can force the professional account to be the default.
To do this, you can add &hd=example.com at the end of the SSO Service parameter's address, replacing example.com with your professional domain name.
Example: mycompany has employees who all have a professional Google account [email protected], and many of them also have a personal Google account @gmail.com. Then you add &hd=monentreprise.ch at the end of the SSO Service parameter. Thus, if the user has both accounts saved on their machine, the @mycompany.com account will be automatically selected.