As a System Admin of an Enterprise account, you can turn on single sign-on (SSO) and allow your employees to login to Deputy via the company's identity provider (IdP). This means employees will only need to remember one password.
Using SSO, you can ensure your employees can use and access Deputy securely.
You will need to use an identity provider that supports SAML 2.0.
For some Frequently Asked Questions around Single Sign-On, check out our FAQ guide.
Supported Identity Providers
Deputy supports, but is not limited to, the following IdP Providers:
- Microsoft Azure
- Oracle Identity Management
Setting up single sign-on
- Go to your identity provider's site and follow the instructions to configure SSO
- You will need the following information to configure SSO in Deputy; X.509 certificate (obtained from IdP)
- Identity Provider login URL / SSO Endpoint (obtained from IdP)
Single Sign On URL input to IdP setup
(subdomain + /exec/devapp/samlacs.php)
- In Deputy, go to the Enterprise tab and under 'General Settings', click 'Single sign on settings'
- Enable single sign-on
- Copy in the X.509 certificate and Identity Provider login URL
- Choose whether you want to make SSO optional or required
Two-factor authentication (2FA) will continue to work if the employee uses their Deputy username and password. Deputy 2FA will be disabled when using single sign-on. If you want that extra layer of security you can configure this in the IdP end.
Employees need to exist within your identity provider. If you are removing employees from the business, they will need to be removed from Deputy as well as the identity provider.
How to Enable 'Single sign-on Required'
This feature is only available for Enterprise accounts.
Enforcing SSO for your employees ensures the following:
- For mobile and web users: Prevents employees from using the supplied email address as set up in the SSO provider with other Deputy accounts
- Employees need to be authenticated by your company's IdP to access the Deputy account
Choosing to make SSO required means your team must login to Deputy with SSO. They won't be able to create or use a Deputy password to login.
'Enforce' Single Sign-On Configuration
First, head to the Enterprise tab and under 'General Settings', click 'Single sign on settings'.
Once you've Enabled single sign-on, ensure that the 'Single sign-on login required' checkbox is ticked.
Remember to click the 'Apply changes' button when you're finished.
Single Sign-On for Mobile
For businesses that use a single set of login credentials for their employees, the Single Sign-On for mobile allows for a more secure and seamless login experience.
Before you begin
To use SSO on mobile, you will need to provide your Deputy URL (subdomain) to your employees. For example, if your URL is exampleurl.au.deputy.com, you will only need to send them 'exampleurl.au'. To learn how to change your URL, check out our help doc here.
First, download the Deputy app. Click the links below depending on your phone's operating system:
After opening the app, tap 'Log In to Deputy.
After that, tap 'Single sign-on'.
Here, enter your account's subdomain.
Now you can enter your SSO details to log into Deputy.
Just-in-time (JIT) Provisioning
Similar to our payroll and HR employee sync, we can add users into Deputy when they are added in your IdP.
JIT eliminates the need to create users (in Deputy) in advanced.
To set this up, navigate to the Enterprise tab and select 'Single sign on settings'.
Scroll down to 'Just-in-time provisioning' and mark the toggle to 'ON'.
A number of fields will appear after toggling this to 'ON'.
Mapping Deputy Attributes to your Identity Provider Attributes
You will need to map Deputy user attributes to the IdP user attributes.
In your IdP config, find the attribute values that match with the following:
- First name
- Last name
- Access level
Fill these in under 'Identity provider attribute'. These mappings will tell the IdP, which user attribute values will populate into Deputy when provisioning users.
You have the option to choose the default value for Location and Access Level.
Location will default to the first location created in the account.
Access Level will default to the lowest access level, this is usually 'Employee'.
Mapping Additional Attributes
If you have more than one location and access level, you can map these as well. Select 'Map locations' and 'Map access levels',
Here you can add the other locations / access levels you want mapped.
Select 'Add new' and a new field will appear.
Fill in that location's attribute (found in the IdP) and make sure it is accurate (case sensitive). If the IdP attribute isn't recognised or there's an error, it will be mapped to the default value i.e. Warehouse.
Click 'Done' to save the changes.
Back in the main SSO settings, click 'Apply Changes' at the top of the page to make sure all changes are saved.