Enterprise / Federated login
Single Sign-On
Let your team sign in to the MemorySync dashboard with your identity provider, using either SAML 2.0 or OpenID Connect.
Providers
Providers you can configure
These are the provider templates available in Settings → SSO. Each one pre-fills the protocol and the fields that provider expects.
SAML 2.0
You will need
- Your provider’s metadata or signing certificate
- The service provider entity id and ACS URL shown during setup
- An attribute mapping for email and name
Assertions are signature-verified on every login, not only when the connection is created.
Setup
What setup involves
- 01Verify your domain
Proving control of your email domain is what lets MemorySync route those users to your provider.
- 02Exchange configuration
Register MemorySync with your provider, then enter the provider details in your organization settings.
- 03Map attributes
Map the email and name claims so accounts are created with the right identity.
- 04Test with one account
Sign in with a single user before enabling it for everyone.
- 05Roll out
Enable SSO for the organization once the test login works end to end.
Boundary
What SSO does and does not cover
- Covers dashboard users
- SSO governs how people sign in to MemorySync.
- Does not cover API keys
- Server-to-server calls authenticate with an API key. Enabling SSO does not change or revoke existing keys.
- First login creates the account
- A user who signs in through your provider is provisioned on the spot, with the default role for your organization.
- Deactivation is a directory action
- Removing access in your provider stops new logins. Use SCIM if you also want the MemorySync account deactivated automatically.
Was this page helpful?