Single Sign-On (SSO) for Authenticating SurveyGizmo Users

These setup instructions will walk you through the basic settings for SSO setup in Active Directory (AD FS). 

Launch the AD FS Management Console. Then, go to Trust Relationships > Relying Party Trusts > Add Relying Party Trust. This will open the Add Relying Party Trust Wizard. Click Start.

Chose the Import data about the relying party published online option and copy and paste your SurveyGizmo SP Meta data URL in the Federation metadata address field. Click Next.

Leave the default option selected for multi-factor authentication and click Next.

On the next screen leave the option to Permit all users to access this relying party selected and click Next.

Navigate to the Advanced Tab and select SHA-256 for the Secure Hash Algorithm.

Review your settings and click Next.

On the next screen leave the option to Open the Edit Claim Rules dialog selected and click Close.

This will take you to the Edit Claim Rules dialog where you will need to a rule. Get started by clicking Add Rule.

In the Claim rule template dropdown menu, select Send LDAP Attributes as Claims and click Next.

We're going to pass through the users email address in SurveyGizmo as the Name ID claim type so name the rule as such.

Select Active Directory in the Attribute Store dropdown menu. 

Select E-Mail-Addresses (or the field in the IDP that matches the users' email in SurveyGizmo) from the LDAP Attribute dropdown menu and Name ID  in the Outgoing Claim Type Dropdown and click Finish and Apply.

Once you finish your IdP setup go back to SurveyGizmo and copy your Login Link. When you go to this link via a browser you will be taken to your IdP login page. Once you log in, you'll be taken to SurveyGizmo.

If this didn't work check out our troubleshooting tips below.

If this does work, now you're ready to set up a button or link for your users to access SurveyGizmo!

1. These setup instructions assists users through the manual setup for SSO in Okta. Okta allows users to utilize an access management system for storing login credentials. 
2. Log into Okta and navigate to Applications. Once there, Select Add Application > Create New App:
3. Once here users see a Create a New Application Integration:
   1. Ensure that the Platform is set to Web and select SAML 2.0 Select Create.
4. Users are brought to the Create SAML Integration page to add the application name (SurveyGizmo) and logos as necessary. Select Next:
5. On the Configure SAML screen (Screenshot below),  provide the Single Sign on URL as well as the Audience URI (SSP Entity ID). For now provide the following placeholders for each field in Okta. These are replaced later in the build with live links:
   1. Single Sign On URL: http://example.com/saml/sso/example-okta-com
   2. Audience URI: http://example.com/saml/sso/example-okta-com
6. Change the Application Username to reflect Email. Whether a username or custom field, the value set for the application username must match the email address for the username that exists in SurveyGizmo.
7.  Click Next to reach the feedback section:
8. Select I'm an Okta Customer adding an internal app. 
9. Click Finish.
10. Users now see the Settings page where one can finish configuring SAML 2.0 on Okta. Select View Setup Instructions to open an additional tab:
11. In the tab that opens up, users have access to the Identity Provider Single Sign-On URL, Identity Provider Issuer, as well as the Certificate. These are unique to each setup:

         Leave these Tabs open! To complete the integration, it is necessary to complete some actions in SurveyGizmo and navigate back into Okta!

12. Open a new tab in the browser of choice and log into SurveyGizmo and from  the Left Hand Navigation menu, select Integrations > Data Connectors. Click the Configure next to the SSO Users option under the Enterprise Level integration  Section. Set the Authentication type to Allow Users to login into the SurveyGizmo Application and the Status to Enable SSO. Leave Name ID Policy as Unspecified:
13. Select Enter SAML Settings Manually below Name ID Policy.
    1. Paste the Identity Provider Issuer Link (found in step 11) from Okta in the Identity Provider Metadata URL field in SurveyGizmo:
    2. Paste the Identity Provider Single Sign-On URL (found in step 11) from Okta in the Login URL Field that exists in SurveyGizmo
14. Next, navigate back to the Okta tab containing the SSL/Signing Certificate. Select Download just under the field where the certificate exists:
15. Once the download completes, navigate back into SurveyGizmo and upload that file for the SSL/Signing Certificate.
16. When the file exists in SurveyGizmo, select Save and Get Metadata. This provides the Raw XML data from the service provider. To update the SP Metadata for previously created integrations, select save and get metadata for most recent certificate information.
17. Right click the hyperlink Service Provider metadata URL and open this in a new tab, or expand the Service Provider Metadata Field to view the necessary information:
18. After the XML file is accessible, navigate back to the SAML app within Okta, and select the General Tab, scroll down to the SAML Settings section, and select Edit. Navigate to the Configure SAML section by clicking Next:
    1. To update the SP Metadata for previously created integrations for the most recent certificate, select save and get metadata for most recent certificate information.
19. Populate the Single sign on URL with the Assertion Consumer service link that is found at the bottom of the XML file or in the Service Provider Metadata section in the SurveyGizmo application. This appears as an HTTPS link:
20. Populate the Audience URI (SP Entity ID) with the Entity Descriptor entityID that is found at the top of the XML file or in the Service Provider Metadata section in the SurveyGizmo application. Click Next to move to the final page
21. Select Finish at the bottom of this page to save:
22. The last step in Okta is to navigate to the Assignments Tab and select Assign. 
23. Select  Assign to Groups. Each user in the group who is assigned here will have access to the application. 
24. Navigate Back to SurveyGizmo and Save the integration.
25.  Open the integration in SurveyGizmo and at the bottom is the unique SSO login link. Copy the  SSO login link and paste it into the browser of choice. The link when opened displays as the screenshot below. Provide the login credentials for Okta  and select Sign in. The user is brought into the SurveyGizmo application. 

Auth0 allows for rapidly integrated authentication with several applications that are used for accessibility and security needs. SurveyGizmo is integrated with Auth0 to allow  users to login securely. 

1. Within Auth0, select Applications and Create application:
2. Provide the intended App name and select Regular web Applications on the Create Application screen. Select Create:
3. Choose Add-ons and enable SAML2 WEB APP. Select Usage tab. From here copy the identity provider metadata download URL:
4. Open a new tab in the browser of choice and log into SurveyGizmo and from the Left Hand Navigation menu, select Integrations > Data Connectors. 
5. Select SSO Users and provide the Integration Name  
6. Paste in Identity Provider Metadata URL and select Save and Get Metadata. 
7. In the Service Provider Metadata field that populates, expand the Field from dragging the bottom right corner. Locate the AssertionConsumerService URL (best for FireFox users) and copy the URL for later use OR  right click Service Provider Metadata URL and open the link in a new tab. 
   1. If one opens a new tab, copy the AssertionConsumerService URL to be used later.
   2. To update the SP Metadata for previously created integrations for the most recent certificate, select save and get metadata for most recent certificate information.
8. Save the integration on SurveyGizmo.
9. Jump back to the Autho Addon:SAMPL2 Web App Screen. Paste in the AssertionConsumerService URL in the Application Call Back URL Field. In the settings field, Paste the following:

   1. {
      
        "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
      
        "nameIdentifierProbes": [
      
          "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
      
        ]
      
      }

   2. 
10. Select Save at the bottom of the screen.
11. Head back into SurveyGizmo and edit  the integration.  Once there use the login link to authenticate via Auth0 into SurveyGizmo:

The OneLogin identity and access management solution allows users to securely be connected to SurveyGizmo and other applications. 

1. First Log into OneLogin. 
2. Select Administration in the top right, then Applications > Add App > SAML Test Connector (Advanced) SAML 2.0:
3. Populate a Display Name and select Save in the top right.
4. Select SSO from the left menu, and copy the Issuer URL for later use in SurveyGizmo. leave OneLogin open in a separate tab. 
5. Open a new tab in the browser of choice and log into SurveyGizmo. From  the Left Hand Navigation menu, select Integrations > Data Connectors. Select SSO Users under the Enterprise Level Integration section:
6. Provide the Integration Name,  For the Authentication Type choose Allow users to login to the SurveyGizmo Application. Leave the Name ID Policy as unspecified, Signature Algorithm as SHA1. and the Signed Metadata field as No. Paste the Issuer URL in the Identity Provider Metadata URL field:
7. Select Save and Get Metadata. In a new tab open the Service Provider Metadata URL and select Save at the bottom right of the integration window.
   1. To update the SP Metadata for previously created integrations for the most recent certificate, select save and get metadata for most recent certificate information.
8. Navigate back into OneLogin, and click Configuration. 
   1. In the Audience (entityID) field paste the Entity Descriptor URL that is in the Service Provider Metadata tab opened from SurveyGizmo. 
   2. In the Recipient field, paste in the Assertion Consumer Service URL that is in the Service Provider Metadata tab opened from SurveyGizmo. 
9. In the ACS (Consumer) URL Validator field paste the AssertionConsumerService URL that is in the Service Provider Metadata tab opened from SurveyGizmo.
   1.  In the ACS (Consumer) URL field paste the AssertionConsumerService URL that is in the Service Provider Metadata tab opened from SurveyGizmo:
10. Select Save in the top right. Navigate back to SurveyGizmo and edit the OneLogin integration. Copy the Login Link at the bottom of the integration window to authenticate via OneLogin into SurveyGizmo. 

Ping Identity makes security simple with strong authentication for SSO. Within Ping Identity is the enterprise solution of PingOne, allowing for simple and intuitive SSO for a variety of applications. 

Setup

1. Log into PingOne as an administrator to build this integration. Select Applications on the toolbar across the top of the page.
2. Click the Add Application Dropdown and select Search Application Catalog. Locate SurveyGizmo by typing in the search field:
3. Click SurveyGizmo and select Setup to continue. This displays the SSO setup instructions needed to build out Single Sign-On. Download the Signing Certificate for upload into SurveyGizmo. Leave this PingOne tab open:
4. Open a new tab in the browser of choice and log into SurveyGizmo. From  the Left Hand Navigation menu, select Integrations > Data Connectors. Select SSO Users under the Enterprise Level Integration section:
5. The setup screen for SSO is displayed. Provide an Integration Name, select Allow user to login to the SurveyGizmo Application,  Enable SSO, and choose Enter SAML settings manually:
6. In the Upload SSL/Signing Certificate field, Upload the Signing Certificate that was downloaded from PingOne in step 3. Click Save and Get Metadata.  Right click the hyperlink Service Provider Metadata URL and open this in a new tab. Leave this tab open as information from this is needed for later steps in the set up. 
   1. To update the SP Metadata for previously created integrations for the most recent certificate, select save and get metadata for most recent certificate information.
7. Navigate back to the previously opened PingOne tab and click the Continue to Next Step button to reach the Connection Configuration page:
8. Navigate back the tab opened in step 6. Copy the AssertionConsumerService from the XML tab opened from SurveyGizmo and paste the link in the ACS URL field in PingOne. An example below shows where to find this in the XML file opened from SurveyGizmo. 
   1. This information is also available from expanding the Service Provider Metadata field by draggin the box from the bottom right corner:
9. Copy EntityID from the XML tab opened from SurveyGizmo and paste that link in the ACS URL field in PingOne. An example below shows where to find this in the XML file opened from SurveyGizmo:
   1. This information is also available from expanding the Service Provider Metadata field by draggin the box from the bottom right corner.
10. Click Continue to Next Step. In the mapping screen select Email for the Name ID. 
11. Select Continue to Next Step. Provide any changes to the description and click Continue to Next Step to reach the groups page. Choose which groups in PingOne that can access SurveyGizmo and click Continue to Next Step to reach the Review Screen. 
12. In the Review Screen, copy the Issuer URL and paste this in the SSO integration in SurveyGizmo in the Entity ID field:
    
13. Once on the review screen in Ping, copy the Initiate Single Sign-On (SSO) URL and paste this in the SSO integration in SurveyGizmo in the Login URL field:
14. Save the integration in SurveyGizmo. Use the initiate Single Sign-On URL to log into SurveyGizmo.

You can set up as many SSO integrations as you wish via Integrations > Data Connectors. To test SSO using a sandbox environment simply set up a separate integration here. 

The Name ID that you pass into SurveyGizmo to identify the user must be the same as their Email field in SurveyGizmo. In the IdP setup above we added a rule to set Name ID = UPN (the users IdP email address).

Check the login link to see if it contains a ~ character. If it does regenerate a new login link in Okta.

This depends on how you set this up. If you wish to allow your users to continue to login via the SurveyGizmo with their username and password make sure to leave the option to Restrict Login to SSO Only unchecked.

This depends on a couple of factors: (1) your Restrict Login to SSO setting and (2) how the user was created.

• If the Restrict Login to SSO box is unchecked all users will be able to login via both your IdP and SurveyGizmo, with the exception of users created via SSO.
• If the Restrict Login to SSO box is checked, any users that attempt to login directly via SurveyGizmo will not be able to and will see the following message:
  This account is restricted to Single Sign-On only. Please contact your account admin for assistance.
• Administrative users that were created in SurveyGizmo will always be able to login via both your IdP and SurveyGizmo regardless of the status of the Restrict Login to SSO option. 
• Users created via SSO will only be able to login via the IdP.

This depends on a couple of factors: (1) your Restrict Login to SSO setting and (2) how the user was created.

• If the Restrict Login to SSO box is unchecked all users will be able to login via both your IdP and SurveyGizmo, with the exception of users created via SSO.
• If the Restrict Login to SSO box is checked, any users that attempt to login directly via SurveyGizmo will not be able to and will see the following message:
  This account is restricted to Single Sign-On only. Please contact your account admin for assistance.
• Administrative users that were created in SurveyGizmo will always be able to login via both your IdP and SurveyGizmo regardless of the status of the Restrict Login to SSO option. 
• Users created via SSO will only be able to login via the IdP. If they try to login via the SurveyGizmo login page they will receive a message letting them know that login is restricted to SSO only.

We cannot throw an error in this case. Typically you'll receive a browser message that the page cannot load.

SurveyGizmo sessions expire after 2 hours of inactivity. If this happens the Continue Working link that displays in SurveyGizmo will not work. Users will need to use the login link/button to log back into SurveyGizmo.

You can! Data from attributes will populate User Data Fields by default as long as the following requirements are met:

• User Data Fields must already be set up. Learn more about setting up User Data Fields. 
• Your SSO Attributes and User Data Field names must match exactly (case sensitive).

Yes. Here is an example of our metadata XML. Please note that the metadata will vary for each customer; when you set up SSO and enter your settings, the metadata file for your setup specifically will be generated.

Take your login URL and append a query string with r parameter like so:

Yes.

NameID must be in the subject of the assertion.

No.

No.

No.

No.

Yes, a signature is required. Encrypted assertions are not accepted.

Username and password form or SSO.

No, we assign it.

This feature has moved and can now be found under Account > Summary > Security and Compliance. Visit the Automatically Disable Users documentation for additional information.

Often this is due to a invalid certificate. Make sure that you are uploading a valid .crt file. Files must be Base64 encoded and must include the the begin and end tags. The result should look like this:

-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----

Use this SSL Checker to validate your file.

The content of this error varies so if you receive an error during set up check that both of these fields are populated correctly.

Microsoft's IdP software.

This is the globally unique URL/string of your IdP entity. It's like a mailing address that we, the service provider, use to contact your IdP.

Your Entity ID can be found in your AD FS Management Console by right-clicking the AD FS Folder and selecting Edit Federation Service Properties. 

The URL in the Federation Service identifier field.

The source of truth for usernames and passwords.

This is the URL for logging in to your IdP. The Login URL is often very similar to the Entity ID URL. This is where we will send the SAML request.

Unique string to identify users. When sending Name ID to SurveyGizmo we recommend it be their email address.

The web-based application/s that are accessed via the IdP.

an XML standard that allows secure web domains to exchange user authentication and authorization data. Using SAML, an online service provider can contact a separate online identity provider to authenticate users who are trying to access secure content.

Provides partner companies with full control over the authorization and authentication of hosted user accounts that can access web-based applications.

This is your certificate file (.crt) for your IdP which can be downloaded from your SSL Issuer. We require base64 encoded files that include the begin and end tags. The result should look like this:

-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----

Use this SSL Checker to validate your file. 

Note:  If the file you have also has the ‘intermediate’ or ‘root’ certificate chains in them, that’s fine, as long as it has the main certificate for the domain included.

The Name of the system user in email address format.