.png)
Single Sign On (SSO) FAQs
This is your go-to reference to understanding the Single Sign On (SSO) capability with the most common questions answered for you. What it is, how it works and what action to take when errors occur. If you are new to using SSO, start with Setting Up Single Sign On for a full overview.
Jump to: Over View • Setup & Configuration • Access & Provisioning • Sign-in & Security • Maintenance & Support
Single Sign On Overview
| Question | Answer |
| Why is SSO required for employees to view Fill in the Blank data in the GovDocs Intranet Poster Program? |
SSO is required to ensure only your employees are authorized to view and access the private company data added to your digital labor law posters. |
| Which identity providers does GovDocs support? |
GovDocs supports Microsoft Entra ID (formerly Azure Active Directory) and Okta through SAML. If your organization uses another provider, contact your Customer Success Manager with its name so we can review compatibility and plan for future support. |
| Once SSO is enabled, will SSO be set up and required on all GovDocs solutions? |
Yes! All users in your GovDocs Platform will be required to use SSO once it is turned on. Note: You can easily disable it if needed in the future. |
| Once SSO is enabled, does the link change for our Intranet Poster Program? | No, the link does not change. |
Setup and Configuration
| Question | Answer |
| How do I upload/input my SSO configuration into GovDocs? |
You will use a self-service SSO Configuration tool. Contact your Customer Success Manager to setup access for you or your IT team to begin the process. Once you have access, set up your SSO integration with this documentation. |
| Do we need to upload a signing certificate or metadata file? |
No. Enter your provider’s SAML metadata URL in GovDocs SSO Settings. GovDocs retrieves the metadata and signing certificate from that URL; there is no separate file-upload step. For certificate rotations, see Signing certificate changes in this Knowledge Center article. |
| I have enabled SSO, but SSO is not required for authentication to our IPP link. How do I enable this? |
Once SSO is configured and enabled, reach out to your GovDocs Customer Success Manager to let them know it's ready to go! Then it will work for your Intranet Poster Program and all other GovDocs solutions. |
Access & Provisioning
| Question | Answer |
| Is SCIM or just-in-time (JIT) provisioning supported? |
Just-in-time (JIT) provisioning is supported. Users who successfully sign in through SSO automatically receive access to their company's digital labor law postings. Automated SCIM provisioning's are currently not supported. Users who need to manage company information or configure SSO settings must have their accounts and permissions set up in GovDocs by your Customer Success Manager. |
| Is there a "user cap" for SSO? | No. There is no user cap. Unlimited users are supported. |
| Does GovDocs required or recommend restricting SSO access to a specific security group? | Access settings like this are up to the client to configure. On the GovDocs end, user access is defined at two levels: who has access? and what access do they have? A user who has access via SSO will gain “View Only” access to IPP Only by default. They do NOT gain access to the rest of the platform. An SSO user must also have additional access granted by a GovDocs Customer Success Manager to access other parts of the platform. |
Sign-In & Security
| Question | Answer |
| How often do users need to authenticate? |
Users with an active GovDocs session can continue accessing GovDocs without signing in again. When sign-in is required, users are directed to your identity provider. If they already have an active session there, they may return to GovDocs without entering credentials again, depending on your organization's sign-in policies. |
| Who controls MFA and password requirements for SSO? | Your organization’s identity provider controls password requirements, multi-factor authentication (MFA), and other sign-in policies for SSO. Your IT team manages those settings. |
| I set it up, why isn't Single Sign On showing on my login screen? |
Once SSO is configured and enabled, reach out to your GovDocs Customer Success Manager to let them know it's ready to go! Then it will work for your Intranet Poster Program and all other GovDocs solutions. |
Maintenance & Support
| Question | Answer |
| What ongoing maintenance is required of me and what does GovDocs handle? |
Once configuration is complete, the client will not have any configuration maintenance. Since each client provides GovDocs a URL pointing to the metadata file rather than uploading the file and certificate, AWS Cognito (GovDocs identity back-end) auto fetches it and picks up certificate rotations on its own. What You Will Maintain: Normal IdP tasks:
|
| How do I get in contact with GovDocs IT Support team? | Reach out to your Customer Success Manager with any IT Support questions and they will route the question to the proper team within GovDocs. |
Deep Dive Why Single Sign on Is Required for Fill in the Blank to Work on Digital Postings
The standard Intranet Poster Program (IPP) link has no authentication, meaning users do not need to login to view the content. This means that anybody who has the link can view the digital posting content. Placing the link behind a login in the HRIS system does not protect the data because the link itself is not protected. The authentication that occurs in the HRIS system is not transferred from the client to IPP. The IPP link is fully independent. If an employee accidentally (or intentionally) shares the link outside the HRIS system, then that link is exposed to the full Internet and could be crawled by search engines, AI systems, and viewed by anyone, anywhere.
If the data in IPP is only GovDocs owned data, no FITB data added, then the additional access control (authentication) requirements is not be needed, GovDocs takes on the risk. Once a client adds company private data, the risk shifts from GovDocs to the client. And since some of that company's private data is Personally Identifiable Information (PII), the rules around who is authorized to access it change. (PII and company private data should be only viewable by employees of the client company.) This means that IPP with Fill in the Blank data must be only available to identified and authenticated employees of the client company.
Single Sign On (SSO) offers a way for GovDocs to integrate with the client’s user authentication system. In less than 5 minutes of setup time, a client can enable access to IPP (and the entire GovDocs Platform) for all employees. This allows for a seamless and nearly instant integration between GovDocs and the client. Once SSO is setup, authentication is now available for IPP, for all employees. The IPP link is now controlled and company private & PII data is now protected from being shared publicly.
If a client does not currently have SSO internally, activation of IPP with FITB data is not possible. The ELC team explored other methods for enabling an authenticated experience in IPP and determined that SSO is the only feasible and secure method. The ELC team also consulted with legal counsel to confirm our stance on protecting client company private data.
Important Note: If GovDocs IPP causes company private or PII data to become publicly available due to us not taking the necessary steps to prevent unauthorized access, GovDocs takes could take on legal liability for this “leak” of information.