Zingtree supports Single Sign-on (SSO) as a means of restricting access to trees. Many customers have sensitive corporate processes or procedures encapsulated in their trees, and ensuring these trees are accessible only to certain employees can be invaluable.
Single Sign-on can be enabled with separate login systems for:
- Employees/agents/end-users.
- Tree Authors.
Single Sign-on is a service provided by many vendors, including Okta, Microsoft (ADFS / Active Directory / Azure), Google (G-Suite), Salesforce and more. These services are known as Identity Providers. A single log-in through an Identity Provider gives a user secure, authenticated access to applications provided by Service Providers like Zingtree.
Once you log in through your Identity Provider, you don’t need to re-enter your login credentials. SSO is a very convenient way to secure access to your applications, while not burdening end-users with extra hurdles.
Zingtree supports any service that is SAML 2.0 compliant, which is a common standard.
Set Up Overview
Configuring SSO requires your Identity Provider and Zingtree to share information with each other:
- Your Identity Provider needs information about Zingtree.
- Zingtree needs information about your Identity Provider.
Configuring Zingtree for SSO
To start, in the Zingtree top menu, go to Account, Single-Sign-on. You can specify SSO for either Agents (employees or end-users) or Authors.
You’ll see the parameters (specific to your organization) to share with your Identity Provider. Here’s how agent view appears:
If you’re setting up SSO for Authors, click this button:
You can switch back to Agent setup by clicking this:
Configure your Identity Provider with these parameters.
Next, click the blue button to Enter Identity Provider Data into Zingtree. The following screen appears:
Copy the rest of these settings from your Identity Provider.
Click Save Identity Provider Settings when finished.
SSO just needs to be set up once for your organization.
Testing Your SSO Setup
Once you’ve set up your Identity Provider and Zingtree for SSO, you can test from Zingtree as follows:
- In Zingtree, go to Account, Single Sign-on. This SSO configuration screen appears:
- Click the green Test Author Login or Test Agent Login button at the lower right of the page.
From here. you can test logging into your Identity Provider from Zingtree. If you’re already logged in, the test will just return your email or another identifier from your Identity Provider. If you’re not yet logged in, the Identity Provider’s login screen will appear, and then you will be returned to the Zingtree SSO test page after logging in.
Enabling SSO for Agents/End Users
Once SSO is working properly from your test, you can restrict access to any tree as follows.
- From Account, Single Sign-on, make sure you are on the Agents page.
- Tick enable Agents.
IMPORTANT: You still need to specify individual trees to restrict access to. Here’s how:
- Go to My Trees, and select the tree that you want to require SSO login.
- Click the Settings tool, and you’ll see something like this:
- Check Require Single Sign-on (SSO) Login to Access.
- Click Update Settings.
Dedicated Agent Login
Rather than having Agents go through the Zingtree login page, you can send them directly to your SSO login page. Here’s how:
- Go to Account, My Agents.
- Give your agents the link from this button:
Enabling SSO for Authors
From Account, Single Sign-on, switch to SSO for Authors:
Make sure Enable Authors is ticked:
One More Step: You also need to add authors to your organization via Account, My Authors. They will not be required to use a Zingtree login to gain access, but this also validates them as a person who has access to an organization’s trees.
The rest of the setup for sharing information with your identity provider is identical to Agent Setup.
This article was originally published on April 4, 2017 and has been updated on January 8, 2018 to include enhanced SSO capabilities and improvements.
Click Continue when the email is set up correctly.
