4

SSO

Last Update hace 14 horas

Single Sign-On (SSO) Overview Set Up SSO with Google Workspace Set Up SSO with Microsoft Entra ID Set Up SSO with Okta

Single Sign-On (SSO) Overview

Let your team sign in to BounceBan with your company's identity provider (SAML 2.0 or OpenID Connect).

Gavin

Last Update hace 14 horas

With Single Sign-On (SSO), people on your team sign in to BounceBan with their work account in your company's identity provider (IdP), such as Okta, Google Workspace or Microsoft Entra ID, instead of a BounceBan password. You manage who has access in one place: new people get a BounceBan account on your team the first time they sign in, and people you remove from your identity provider can no longer sign in with SSO.
Before you start
  • SSO is an enterprise feature and is off by default. The team owner needs to contact their account manager or [email protected] to turn it on for the team. Once it is on, the owner sees SSO in the account menu (top right).
  • SSO is set up per team. The team owner, and any team admins (see below), can set it up at https://bounceban.com/app/account/sso.
  • You need access to your company's DNS settings (to verify your email domain) and admin access to your identity provider.
Supported protocols and identity providers
BounceBan supports SAML 2.0 and OpenID Connect (OIDC), plus SCIM 2.0 for automatic provisioning.
Step-by-step guides:
Other identity providers that support SAML 2.0 or OpenID Connect should also work: use the settings shown on your SSO page.
How to set up SSO
Go to https://bounceban.com/app/account/sso (account menu > SSO). The page has five steps.
1. Verify your domains
Only people whose email addresses are on a verified domain can sign in with SSO.
  1. Enter your domain (for example acme.com) and click Add domain.
  2. In your DNS settings, add the TXT record shown at the root of the domain (Host / Name @). The value looks like bounceban-domain-verification=….
  3. Click Verify. DNS changes can take up to a few hours to take effect; if verification doesn't succeed yet, try again later.
Notes:
  • You can add up to 20 domains.
  • Public email domains (such as gmail.com or outlook.com) can't be used.
  • A domain can be verified by only one BounceBan team. If another account has already verified your domain, contact [email protected].
  • If you remove a verified domain, you need to verify it again to use it for SSO.
2. Set up your identity provider
Create an application for BounceBan in your identity provider, choose SAML 2.0 or OpenID Connect on the SSO page, and copy the settings between the two.
  • SAML 2.0: enter BounceBan's Entity ID (Audience URI) and ACS URL (Reply URL) in your identity provider (the Sign-on URL is optional). Send the user's email address as the Name ID, or as an email attribute. Then copy the IdP Entity ID (Issuer), IdP SSO URL (Login URL) and the signing certificate from your identity provider into BounceBan. If your identity provider publishes a metadata URL, paste it in IdP metadata URL (optional) and click Load to fill these in; BounceBan also checks that URL every day to pick up new signing certificates.
  • OpenID Connect: enter BounceBan's Redirect URI in your identity provider (the Initiate login URI is optional). BounceBan asks for the scopes openid email profile. Then copy the Issuer URL, Client ID and Client secret into BounceBan.
Click Save.
The BounceBan URLs are unique to your team and look like https://bounceban.com/sso/saml/
3. Test and turn on SSO sign-in
  1. Click Test connection. Sign in with your own account in your identity provider. The test uses your saved settings and shows what your identity provider sent, which email address BounceBan will use, and what will happen when that person signs in. It doesn't sign anyone in.
  2. When the test succeeds and at least one domain is verified, turn on Turn on SSO sign-in.
Other options in this step:
  • Allow sign-in from the identity provider's app dashboard (IdP-initiated) (SAML only): lets people open BounceBan from the app tile in their identity provider. When this is off, people must start from the BounceBan sign-in page.
  • SSO session length: people who sign in with SSO are signed out after this time (1 hour to 7 days, default 12 hours) and sign in again through your identity provider. Applies to new sign-ins.
  • Require SSO for team members: see "Require SSO" below.
If you later change your identity provider settings (for example the protocol, issuer, URLs, certificates or client secret), SSO sign-in is turned off automatically. Test the connection again, then turn it back on.
4. Automatic provisioning (SCIM) — optional
Let your identity provider add, update and deactivate team members automatically.
  1. Click Generate token (available after at least one domain is verified). Copy the token right away; you won't be able to see it again.
  2. In your identity provider, use the SCIM base URL (Tenant URL) shown on the page (https://bounceban.com/scim/v2) and the token as a Bearer token. Use userName (the work email address) as the unique identifier.
Only email addresses on your verified domains can be provisioned. When someone is deactivated or unassigned in your identity provider, they can no longer sign in, their sessions end and all their API keys are replaced, so the old keys stop working. They show as Deactivated on your Team page.
SCIM provisions users only. Group provisioning (pushing groups) is not supported; turn it off in your identity provider. To set roles from groups, use step 5.
You can Regenerate token (the old token stops working right away) or Revoke it (your identity provider can no longer add or deactivate members; people already deactivated stay deactivated).
5. Team roles from your identity provider — optional
Make people team admins based on their groups in your identity provider.
  1. Set up your identity provider to send the person's groups in the SAML assertion or OIDC token (see the provider guides).
  2. Groups attribute or claim: the name of the attribute or claim that lists the groups (default groups).
  3. Admin groups: one group per line, up to 20, exactly as your identity provider sends them (not case-sensitive). Use Test connection to see the groups your identity provider sends and the role the person would get.
  4. Turn on Set team roles from these groups and click Save.
Each time someone signs in with SSO, they become an admin if they are in one of the admin groups, and a member otherwise. If your identity provider doesn't send any groups, people sign in as members. Roles change at each person's next SSO sign-in. The team owner is not affected.
While this is on, the roles of people on your verified domains can't be changed on the Team page.
How team members sign in
  1. Go to https://bounceban.com/account/sso, or click Sign in with SSO on the BounceBan sign-in page.
  2. Enter your work email and click Continue.
  3. Sign in with your identity provider. You're then signed in to BounceBan.
If the team allows it, people can also open BounceBan from the app tile in their identity provider (IdP-initiated sign-in, SAML only).
BounceBan doesn't ask for its own two-factor code when you sign in with SSO; your identity provider handles that.
New people join your team automatically
The first time someone signs in with SSO (or is provisioned through SCIM):
  • No BounceBan account yet: a new account is created on your team. It has no free trial credits and uses your team's credits.
  • An existing BounceBan account that is not on a team and has never paid: the account joins your team. Any free or trial credits on that account are kept but no longer used while it is on your team.
  • Already on your team, or the team owner: they are simply signed in.
Sign-in is refused, with a message to contact support or their administrator, when the existing account:
  • belongs to another BounceBan team,
  • owns a team of its own (has team members),
  • has its own paid plan or purchases, or
  • is blocked, or was deactivated through SCIM.
Sign-in is also refused when your team has reached its member limit.
To move an existing paid account onto your team, contact [email protected].
Require SSO
When Require SSO for team members is on, team members whose email addresses are on your verified domains can only sign in with SSO:
  • signing in with a password or Google, resetting the password and signing up from an invitation are turned off,
  • their current password sessions end within a minute,
  • API keys keep working.
Before you can turn it on, SSO sign-in must be on and the team owner must turn on two-factor authentication for their own account in their profile (https://bounceban.com/account/profile).
The team owner can still sign in with their password or Google, followed by two-factor authentication, in case your identity provider is unavailable. Each of these emergency sign-ins is recorded in the team audit log. While SSO is required, the owner can't turn off two-factor authentication.
Team admins and roles
Teams with SSO enabled can have admins in addition to the owner and members. On the Team page (https://bounceban.com/app/account/team), the owner or an admin can change a member's role between Admin and Member, unless roles are set from identity provider groups (step 5).
Team admins can:
  • invite and remove members, and change other members' roles,
  • set up SSO and SCIM,
  • view the team audit log.
Team admins can't manage billing (purchases, subscriptions, invoices), change the owner, change their own role, or view members' credit usage. These stay with the team owner.
Team audit log
The owner and admins can see the Audit log at the bottom of the Team page. It lists SSO sign-ins (including failed ones), automatic provisioning, member and role changes, and SSO settings changes. You can filter by category (Sign-in, Provisioning, Members & roles, Settings) and by the last 7, 30 or 90 days.
FAQ and troubleshooting
I don't see SSO in my account menu.
SSO isn't turned on for your team yet. Contact your account manager or [email protected]. If you are a team member (not the owner or an admin), ask your team owner.
"SSO is available for enterprise customers. Please contact [email protected]…" when signing in.
Your email domain isn't verified for SSO by any team, or the team hasn't turned on SSO sign-in yet. Ask your administrator, or sign in the usual way.
"Your email address … is not on a domain verified for SSO."
Your identity provider sent an email address on a domain your team hasn't verified. Verify the domain in step 1, or make your identity provider send the email address on your verified domain.
"Your identity provider did not send an email address."
Set your identity provider to send the email address as the Name ID (SAML) or the email claim (OIDC). Use Test connection to see what it sends.
"Your existing BounceBan account … can't be added to this team automatically."
The account belongs to another team, owns a team, or has its own paid plan or purchases. Contact [email protected].
"Your team has reached its member limit."
Ask your team owner, or contact your account manager or [email protected].
"Please start SSO sign-in from the BounceBan sign-in page."
IdP-initiated sign-in is off. Start at https://bounceban.com/account/sso, or turn on Allow sign-in from the identity provider's app dashboard in step 3.
"Your organization has deactivated this BounceBan account."
Your identity provider deactivated the account through SCIM. Contact your IT administrator.
The test says the SAML response could not be verified.
Check that the signing certificate, the IdP Entity ID and the ACS URL in BounceBan and your identity provider match. If your identity provider rotated its certificate, add the new one (you can keep up to 2 certificates), save and test again.
My role didn't change after I changed groups in my identity provider.
Roles change the next time the person signs in with SSO.
Will our API integrations break when we require SSO?
No. API keys keep working. Keys of people deactivated through SCIM are replaced, so those stop working.
Still need help? Contact [email protected].

Was this article helpful?

0 out of 0 liked this article

Still need help? Message Us