Setting Up Single Sign-On (SSO)

Single sign-on lets your team sign in to GovDocs through your own identity provider (IdP), like Microsoft Entra and Okta, using your existing company credentials. Once enabled, users whose email domain matches your configuration are routed to your IdP to sign in.

Check out the FAQs if you need >>

Setup has three stages:

1. Configure your identity provider and save its metadata URL in GovDocs.
2. Verify your configuration with a test sign-in.
3. Enable SSO when your test passes.

Saving and testing your initial configuration does not turn SSO on.

Before you begin

You’ll need:

• The SSO Manager role in GovDocs. Contact your Customer Success Manager to arrange access.
• Administrator access to your identity provider and permission to create a SAML application.

SSO is configured separately for each company. Your company must have users with an eligible company email domain. Public email domains, such as gmail.com and outlook.com, are excluded.

Step 1: Configure your identity provider

Select your identity provider, then click Begin setup.

The page shows setup steps for your provider, with the values to enter labeled the way your provider’s admin console labels them. Follow the steps on the page, using the copy buttons for each value. For more detail, expand the section for your provider below.

Jump to: Microsoft Entra | Okta

Microsoft Entra

Create the application

1. In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application.
2. Enter a name for the application and select Integrate any other application you don't find in the gallery.
3. Click Create.
4. Open the application’s Single sign-on section and select SAML.

Configure SAML

Under Basic SAML Configuration, click Edit. Set these fields using the corresponding values shown in GovDocs:

Click Save.

The Sign on URL directs users through the GovDocs login page when they launch the application from Microsoft My Apps or use Entra’s Test single sign-on button.

Confirm the email claim

Under Attributes & Claims, confirm that emailaddress is mapped to user.mail. If it is, leave it unchanged.

Make sure the users who will sign in have an email address populated in Entra.

Assign users and copy the metadata URL

1. Open Users and groups.
2. Click Add user/group, select the users who need access, and click Assign. Include the person who will run the sign-in test.
3. Return to Single sign-on.
4. Under SAML Certificates, copy App Federation Metadata URL.

Continue with Save your configuration in GovDocs below.

Okta

Create the application

1. In the Okta Admin Console, go to Applications and Resources → Applications.
2. Click Create App Integration, select SAML 2.0, and click Next.
3. In General Settings (Step 1), set App name to a name of your choice.
4. Under App visibility, select Do not display application icon to users.
5. Click Next.

Hide the SAML application because GovDocs sign-in starts from the GovDocs login page. To provide a tile on users’ Okta dashboards, create a separate Bookmark App using the optional instructions below.

Configure SAML

In Configure SAML (Step 2), set:

Complete the remaining wizard prompts to create the application.

Add the email claim

After creating the application:

1. Open Sign On → Attribute Statements.
2. Click Add expression.
3. Set Name to: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress   
4. Set Expression to: user.profile.email   
5. Click Save.

Make sure the users who will sign in have an email address populated in their Okta profiles.

Assign users and copy the metadata URL

1. Open Assignments and assign the people or groups who need access. Include the person who will run the sign-in test.
2. Return to Sign On.
3. Copy Metadata URL.

Continue with Save your configuration in GovDocs below.

Optional: Add a GovDocs tile to the Okta dashboard

1. Go to Applications and Resources → Applications → Browse App Catalog.
2. Search for Bookmark App and select it.
3. Click Add Integration.
4. Set Application label to the name you want users to see on their dashboard.

5. Set URL to:

   https://elc.govdocs.com/login   

6. Save the Bookmark App.
7. Under Assignments, assign the people or groups who should see the tile on their dashboard.

Users must be assigned to both the SAML application and the Bookmark App.

Save your configuration in GovDocs

When you’ve finished the steps in your identity provider, paste its metadata URL into SAML metadata URL and click Save configuration. The metadata URL must be a publicly accessible HTTPS URL. A URL that only works inside your corporate network or VPN will not work.

Step 2: Verify with a test sign-in

Click Test Sign-In. A separate window opens for you to sign in through your identity provider. Leave the window open until the test finishes.

• If the test passes, a confirmation appears and the Enable button becomes available.
• If the test fails, review the message and seeTroubleshooting. Correct the configuration, then test again.

Step 3: Enable SSO

After your test passes, click Enable and confirm. Users with the configured email domains will now sign in through your identity provider.

Stay signed in to your current window. In a private browser window, go to the GovDocs login page and confirm that you can sign in through your identity provider. If sign-in fails, click Disable in your original window and confirm. Users with the configured domains return to GovDocs password sign-in. Users without a GovDocs password can’t sign in until SSO is enabled again.

Note: If you can’t access GovDocs to disable SSO, contact your Customer Success Manager to have it disabled.

Managing SSO

Email domains

GovDocs detects eligible email domains from your company’s existing users and displays them under Email Domains.

• Configured domains determine which users are directed to your identity provider while SSO is enabled.
• When GovDocs detects a new eligible domain, click Add to configuration to include it. If SSO is enabled, users with that domain will then use SSO.
• The domain of the email address your identity provider sends must match one of your company’s configured domains.

Signing certificate changes

GovDocs refreshes your provider’s metadata automatically but may use a cached copy for up to six hours. If your provider supports publishing multiple signing certificates, publish both the current and new certificates for at least six hours before switching to the new signing certificate. You can then remove the old certificate. If your provider cannot publish both certificates, changing certificates may temporarily interrupt sign-in.

Troubleshooting