A System Master (a Certain team member) can set up "Single Sign-On" (SSO) connections for an account.
An Administrator user enables these SSO connections here. The Administrator user can edit their field mappings and button fields. The page describes the setup “as described below”.
There are three types of SSO in Certain:
- ADMIN – For people signing in to the Certain app itself; as Event Builders, for example. (Details below.)
- ATTENDEE LOGIN – For attendees using registration forms or the Mobile web app, speakers using a Speaker Portal, or reviewers using a Reviewer Portal. (Details below.)
- CHECK-IN APP – For people using the Certain Check-In app to check attendees in at an event. (Details below.)
(See SSO Configuration and Use for an overview of SSOs in Certain.)
Available SSO Connections (List)
All existing SSOs for the current account and its parent account are listed.
To edit an SSO, click the in the Actions column. This action opens the Edit SSO Config pane described below.
The following information is shown for each SSO listed:
- Enabled – If this check box is selected, the SSO is available for use. The user can select or clear the check box right here in the list, without needing to edit the record.
- Note – The user must map fields for the SSO before the user can enable it. The mapping must include at least First Name and Last Name. (See below.)
- Note – Only one ADMIN SSO can be active in a system at any one time.
- Note – Only one CHECK-IN APP SSO can be active in a system at any one time.
- Config Name – The name of the SSO, as set by Certain for your system.
- Config Type – The technical type of SSO, e.g., "OAuth2" or "SAML2".
- IDP Name – The Identity Provider ("IDP") used for authentication. For example, "LinkedIn" or "Facebook".
- Entry Points – "ADMIN", "ATTENDEE LOGIN", or "CHECK-IN APP". See details below.
- Activity – The most recent activity. This includes type (e.g. "Updated"), date, and user name.
- Actions –
- Edit the SSO. See 'Edit SSO Config', below.
Edit SSO Config
This section is displayed when the user clicks in the list to edit an SSO.
This section is also displayed when a Certain System Master clicks Add an SSO Config.
Note – Once an SSO has been set up, it is rare for it to be edited.Information Fields
Entry Points – At least one of the three options: "ADMIN", "ATTENDEE LOGIN", or "CHECK-IN APP". This is read-only information. A System Master user can edit it.ADMIN
ADMIN – For Certain users logging in to the Certain app.
Once signed in to their corporate system (for example, by logging in to their network), these users do not have to enter another user name and password to access Certain.
These users still have to be set up as Certain users in Account Settings > Administration > Users.
Note – Only one "ADMIN" SSO can be active in a system at any one time. Best Practice – If an account has an ADMIN SSO, then ADMIN would normally be that SSO's only Entry Point. (An example exception, probably rare, would be when an account is using forms for staff to register for events via their intranet.)ATTENDEE LOGIN
ATTENDEE LOGIN – For attendees using registration forms to register.
Registration form entry pages can include buttons for automatically pre-filling information from LinkedIn, Facebook, Microsoft, or Google+, for example. See additional fields below for button fields.ATTENDEE LOGIN – For attendees logging in to a Certain Mobile web app.
The Login page in the app can include an option to log in via SSO instead of username and password.
ATTENDEE LOGIN – For speakers logging in to a Speaker Portal.
The Login page in the speaker portal can include an option to log in via SSO instead of username and password.
ATTENDEE LOGIN – For reviewers logging in to a Reviewer Portal.
The Login page in the reviewer portal can include an option to log in via SSO instead of username and password.
CHECK-IN APP
CHECK-IN APP – For Certain users who will be using the Certain Check-In app.
Check-In users can log into the Check-In app by clicking the gear icon on the login page. The user then selects the SSO. The user logs in using those credentials.
Note – Only one 'CHECK-IN APP' SSO can be active in a system at any one time.Config Name
Config Name is required.
The Config Name is the name of the SSO.
Best practice is that the Config Name should be unique in the account to ease identification.
App ID
App ID is required.
The App ID is the unique technical ID for the SSO connection app created by Certain for this SSO. This app is in the separate SSOManager app.
Config Type
Config Type is required.
Config Type is the technical type of SSO.
Examples include O Auth2 and SAML2.
IDP Name
IDP Name is required.
IDP Name is the Identity Provider (IDP) used for authentication by this SSO.
Examples include LinkedIn and Facebook.
Button
These five "Button..." fields are available when Entry Point does not include "ADMIN" or "CHECK-IN APP". These fields are therefore used only for Attendee Login.
These fields can be configured differently for each account and sub-account.
These fields determine the appearance of the button the registrant sees on the form. These fields also determine the appearance of the button the speaker sees on the speaker portal.
- Button Label (Required) – The text on the form button. For example, "Log in with LinkedIn".
- Button Color (Required) – The background color of the form button. The user can click the color picker icon to select a color. The user then clicks Set Color. The user can also enter the hex value. For example, #dddddd for gray.
- Button Text Color (Required) – The color of the text of the Button Label. The user can click the color picker icon to select a color. The user then clicks Set Color. The user can also enter the hex value. For example, #000000 for black.
- Button Icon (Optional) – The user clicks Browse to upload an icon to be used on the button. The icon appears in addition to the text of the Button Label.
- Button Class (Optional) – Advanced users can enter a class name. Users can use this class name in CSS and JavaScript. The class name further customizes the button's appearance. The class name also localizes the text.
Lookup
IDP Fields
IDP Fields – Select the Identity Provider fields that the user will match to Certain Profile fields in the Field Mapping step below.
Note – Only text fields are available for mapping.The fields available vary from one Identity Provider to the next.
For example:
- First Name (or Given Name);
- Last Name (or Surname, or Family Name);
- Email Address, etc.
Profile Lookup
Profile Lookup – Select the Certain profile field to be matched against the IDP field identifying the person.
For example:
- Email, or Nameid.
If that field uniquely identifies a profile then the lookup can succeed with a unique match.
Caution – If the Profile Lookup field is the email address. If the Certain account includes more than one profile with the same email. The lookup will match the most recently updated record.The user can set the Registrant Details section of registration forms to enforce unique email addresses.
Recommended – Map the field the user selects to a Certain field under Edit SSO Config below.Look Up Profile on form re-entry also
Look Up Profile on form re-entry also – Caution applies here.
This setting applies to every login using this SSO connection in all events in this account.
If Look Up Profile on form re-entry also is not selected, then Certain will use the value of the Profile Lookup field to find a matching profile record the first time someone logs in using SSO.
If a match is found, Certain will then "remember" that match.
Even if a person who logged in via SSO later changes the value of that profile field on the Certain side, the person's next login still succeeds.
If Look Up Profile on form re-entry also is selected, then Certain will look up the profile on every SSO login. Certain will use the value from a successful initial login instead of using the Profile Lookup field value from later logins.
Edit SSO Config (Field Mapping)
This section is displayed when the user clicks in the list to edit an SSO for an account.
Map the fields from the Identity Provider (IDP) to their matching Profile fields in Certain.
This mapping is required before the user can enable an SSO connection.
Note – In a sub-account, the user needs to map these fields independently of the parent account because the mappings are not inherited.You must map at least Profile First Name and Profile Last Name in Certain to the equivalent IDP fields.
Important – Do not map Profile First Name and Profile Last Name both to the same IDP field. See the note below.- IDP Fields – Select an IDP field to map to a Certain field.
- The fields the user sees listed are those selected in the IDP Fields drop-down list above.
- For example:
- First Name (or Given Name);
- Last Name (or Surname, or Family Name);
- Email Address, etc.
- Certain Fields – Select the Profile Standard Field or Profile Question to be mapped to the selected IDP Field.
- For example:
- Profile First Name;
- Profile Last Name;
- etc.
For example, if an account's IDP fields include Given Name, Family Name and Name, then Name probably concatenates the other two.
If Given Name equals "Jane". If Family Name equals "Citizen". Then Name would automatically be "Jane Citizen".
Correct procedure in this example:
- Map Given Name in IDP to Profile First Name in Certain.
- Map Family Name to Profile Last Name in Certain.
- Both fields are used in Certain. Her name will appear as "Jane Citizen".
Wrong procedure in this example:
- If the user mapped Name to both Profile First Name and Profile Last Name in Certain.
- Then both fields for that attendee would be "Jane Citizen".
- The attendee would therefore appear to be "Jane Citizen Jane Citizen" wherever the attendee name appears in Certain.
- Updatable – If this check box is selected, then the Certain field is updated when a registrant logs back in after the value of the IDP field has changed since the registrant last logged in.
This avoids potential problems. This includes inadvertently changing an email address.