SSO (Single Sign-On) offers a quick and convenient login method for all employees. With SSO, you can automatically grant viewing access to all, or selected, employees within your company. SSO is available as an add-on for Enterprise accounts. For more details, please refer to our introduction and FAQ.
Getting started
To enable SSO for your brand portal, go to the Customer Hub and look for the option to submit an SSO setup request (under the Ecosystem section).
Once your request is submitted, our Support team will contact you by email to complete the setup.
If you need help with your SSO configuration at any point, feel free to reach out to support@frontify.com.
Okta - Configuration example
Group attributes with Okta
User groups help manage access permissions to Style Guides, Projects, Libraries. By assigning the right people to the right group you can avoid individually inviting everyone to specific content.
With SSO group mapping, you can set up groups based on your internal departments, functions, or other commonalities and assign several team members to various projects at once. Learn more about setting up User Groups with SSO (group mapping).
Based on our experience, we have found a working way that shows you how to send your group's details from Okta to Frontify:
Create the attribute User.Groups in your SAML settings that matches regex values:
The plain text of the regex filter might look like one of these scenarios:
.*Marketing.*|.*Sport.*|.*Brand.*
OR
\.*Marketing\.*|\.*Sport\.*|\.*Brand\.*
The values are matching the group names in your Okta account:
2. Then add sso_mapping values in the Frontify User Management page -> Groups tab. This is described in detail in the User Groups with SSO (group mapping) article.
3. Test if the setup works. Ask a user from your user directory that belongs to a group on your end to logging in to Frontify via SSO.
On the User Management page, check if the user belongs to the mapped group. You can also invite the mapped group to a Style Guide and see if the user has group-based permission to the Style Guide.
Enabling Single Logout (SLO)
SAML Single Logout (SLO) lets you log out of all connected systems, including Frontify and your Identity Provider (IdP), in one action. When you log out of one system, you are logged out of all connected systems. For SLO to work, both the logout request and the logout response must be signed. Frontify supports signed logout responses, and your IdP must be configured to handle them.
This can be found by selecting "Show Advanced Settings" under "SAML" settings > "Allow application to initiate Single Logout" here:
By default, the Frontify logout button logs you out of Frontify only. It doesn't trigger SLO or log you out of your IdP. While SLO can be initiated from the IdP side, we can also enable Frontify's logout button to trigger SLO at the account level.
Before enabling SLO at the account level, consider the following implications:
It applies to all domains under the account and cannot be limited to specific users.
Non-SSO users may have trouble logging out if only SLO is triggered.
To configure SLO in Okta:
Navigate to your app's SAML settings and select Show Advanced Settings.
Check Allow application to initiate Single Logout.
Enter your Frontify Single Logout URL in the appropriate field.