Single Sign-on integration

Although a login is not required to take surveys, users (account managers, account admins, report viewers) however, must login to access results.

Single sign-on (SSO) allows users with access to login with their existing organisation's credentials, and will not need to keep separate credentials to access AskYourTeam.

AskYourTeam seamlessly integrates with any external system capable of acting as a SAML 2.0 identity provider. When the SSO integration is enabled, users will only be able to login using single sign-on. 

About SAML 2.0

SAML (Security Assertion Markup Language) is an XML-based protocol that uses security tokens containing assertions to pass information about a principal (usually an end user) between an Identity Provider such as Microsoft ADFS, and a Service Provider application such as AskYourTeam. 

If your Identity Provider (iDP) supports the SAML2.0 protocol, then AskYourTeam can be configured for single sign on as a Service Provider.

How to configure single sign-on

SSO will need to be configured within the AskYourTeam system and Microsoft ADFS

Setup single sign-on with Microsoft ADFS

Add a new Relying Party Trust

1. In your ADFS configuration, right click Relying Party Trust 
2. Click Add Relying Party Trust
3. Enter the Entity ID from AskYourTeam (see screenshot above) as the metadata URL
4. All settings should be configured automatically

Edit Relying Party Trust rules

Once you have created the Relying Party Trust, two claim rules need to be added.

1. Right click and select Edit Claim Rules...
2. Click Add Rule... to add a Send LDAP Attributes as Claims rule
   1. Attribute store: Active Directory
   2. LDAP Attribute: E-Mail-Addresses
   3. Outgoing Claim Type: E-Mail Address
3. Click Add Rule... to add a Transform an Incoming Claim rule
   1. Incoming claim type: E-Mail Address
   2. Outgoing claim type: Name ID
   3. Outgoing name ID format: Email
   4. Pass through all claim values
4. You should now have two rules defined.

Configure SSO integration in AskYourTeam

1. Login to the AskYourTeam system
2. Navigate to My Organisation
3. Select the Integrations tab
4. Click Connect under Single Sign-On
5. Enter the SAML Single Sign-On Service URL
   • This can be found in your ADFS configuration
6. Enter the SAML Entity ID
7. Enter a Sign-Out URL
8. Enter the SAML Signing Certificate
9. Once completed, hit Save