Use your company authentication to log in to ContractSafe
Using SAML 2, ContractSafe allows users to log in with their identity provider, such as Okta or Azure Active Directory. This article provides a step-by-step guide on configuring Single Sign-On (SSO) and covers common troubleshooting issues.
Caution : Before making changes to the SSO settings please make your account SSO Excluded, admin level access is required. Article on how to right Here.
Note : If you're upgrading to our new SP-initiated SSO, don't remove configuration for the existing IdP-initiated SSO until you've confirmed that the new settings are working. We encourage you to create a new app in your identity provider that you can fully test SSO settings without affecting your users' existing workflow.
When you enter the SSO settings dialog as an customer with an existing SSO integration, you will see two tabs: IdP-initiated (the legacy SSO integration) and SP-initiated (the new SSO integration). The screenshots below only reflect the new SP-initiated settings tab.
Enabling SSO generic Guideline
This is a general guide and should help you configuring Single Sign-On for all providers. If you encounter any difficulties please reach out to our support.
Now, let's start!
Creating the SSO Provider:
- From the Settings page, select the Security & Integrations button.
- Click on the Single Sign-On Settings button.
- Click Create SSO Provider to generate the necessary URLs for your identity provider.
Checking the Email Domain:
- In the Single Sign-On Settings dialog, confirm that the Email Domain matches the domain of your users' email addresses.
- If incorrect, contact ContractSafe support@contractsafe.com with the desired email domain.
Setting Up Your Identity Provider:
- Use the details provided in the Single Sign-On Settings dialog to configure your identity provider.
- Add an attribute or claim to the payload you send us with a name of email. This is how your identity provider tells us which user it is.
- For some identity providers, the metadata URL may be the best to use, while others may require the ACS URL.
- Obtain a metadata URL from your identity provider to provide to ContractSafe to complete the setup.
- Paste the metadata URL into the Single Sign-On Settings dialog.
Test the Configuration
- Copy the Login URL from the Single Sign-On Settings dialog.
- Log out of ContractSafe or open a private browsing window.
- Paste the URL into your browser; it should redirect to your identity provider.
- After logging in, you should be redirected back to ContractSafe.
- If successful, a message confirming SSO is not enabled will appear.
Enabling Single Sign-On:
- If the test is successful, go to Settings, then click on Security & Integrations.
- Activate the toggle labeled Single Sign-On to enable it for your organization.
Troubleshooting
Signing and digest algorithms
We do not support the deprecated SHA-1 algorithm. We recommend at least SHA-256.
I need to change my email domain
Email domains must currently be configured by ContractSafe support. To change your email domains, please reach out to support with the email domains that your users should be able to use single sign-on with.
It says an "internal error" has occurred
This is most often caused by the "email" parameter not being configured correctly. Ensure that the email is being passed along in the SAML 2 response in a parameter called "email".
It says "Sign Up Closed"
This page is admittedly confusing; it means that the email address we see in the SSO launch has not been invited to your organization. Ensure that you are sending the correct email address for the user, and ensure that you have invited the user to your organization.
It says "SSO domain does not match"
This happens when your SSO email domain doesn't match the email for the user you're trying to log in with. Confirm that your Identity Provider is sending the correct email address to us, and check your Single Sign-On Settings to make sure that the Email Domain matches. If the email domain is incorrect, please reach out to support to change your email domain.
It says to add my email domain
Awesome, you're well on your way to having single sign-on configured! Now, reach out to support and let them know what email domain you want to use.
My identity provider doesn't give me a metadata URL
Some identity providers, such as Google Workspace, do not give a public metadata URL. If your identity provider doesn't give you a metadata URL for you to set in our configuration, they will usually allow you to download a metadata XML file. Upload this XML to a web server you control, then set that URL as the Metadata URL.
It gives an error when I try to use the Login with SSO Provider button
The Login with SSO Provider button on the login page only works with our service provider-initiated (SP-initiated) single sign-on configuration. If you have only our legacy identity provider-initiated (IdP-initiated) SSO configured, you will get an error that informs you that
"Your organization uses our legacy SSO setup. Please log in via your SSO provider portal or contact your admin to set up SP-initiated SSO for your organization."
If you see this message and would like to use the Login with SSO Provider button on the login page, follow the instructions on this page to set up service provider-initiated single sign-on.
I want to change my legacy IdP-Initiated SSO settings
If you need to change your SSO settings for our legacy identity provider-initiated single sign-on, look for the IdP-initiated tab in the Single Sign-On Settings dialog. Only organizations that previously had SSO set up for their organization will see this tab. If you have a special need to use our legacy IdP-initiated SSO and this tab is not available for you, please contact support.
Additional Support:
For further assistance or questions, please reach out to support@contractsafe.com.