Skip to main content

Single Sign-on and SAML

Single Sign-on lets your team sign in to Dreamdata with the credentials they already use at work. You set it up under User Management → Security → Single Sign-on.

There are two options.

Which option to pick​

Social Login signs people in through Google, Microsoft, or Salesforce. You pick the provider and that is the whole setup. It suits teams that already sign in to everything with a Google or Microsoft account.

SAML connects Dreamdata to your identity provider, such as Okta or Entra. It takes more setup. In return, your identity provider decides who can sign in. Choose it if you have compliance requirements, or if you manage access to your other tools centrally and want Dreamdata handled the same way.

Dreamdata supports SAML with Google, Okta, Entra (formerly Azure), OneLogin, JumpCloud, Duo, and Rippling. Any other SAML identity provider works through the Other option.

SAML is also the prerequisite for SCIM

If you want your identity provider to add and remove Dreamdata members automatically, set up SAML first and then add SCIM provisioning.

Who it applies to​

Both options apply to everyone whose email address is on your account's primary domain. The panel shows which domain that is, next to the info icon.

The rule is tied to the email address, so it also applies when someone on your domain opens a partner's Dreamdata account. For SAML to work for them there, they must also be a member of your account. See Troubleshooting if someone on your domain only uses a partner's account.

People on other domains are outside SSO

Members with an email address on any other domain keep signing in with a password or a social provider. They cannot sign in through your identity provider. This includes members from domains you added under Allowed domains further down the Security tab. If your compliance requirements say everyone must come through the identity provider, invite only people on your primary domain.

Setting up Social Login​

  1. Go to User Management → Security → Single Sign-on.
  2. Pick your provider under Social Login Providers.
  3. Select Enable and confirm.

The change takes effect immediately.

You must already be signed in with that provider

Dreamdata will not let you enforce Google Social Login while you are signed in with Microsoft. This stops you locking yourself out by enabling a provider you cannot use. If your current session does not match, Dreamdata says the setup did not go through and offers to log you out. Sign back in with the provider you want to enforce, then repeat the steps above.

Setting up SAML​

  1. Go to User Management → Security → Single Sign-on.
  2. Pick your identity provider under SAML Identity Providers.
  3. Select Start SAML setup. Dreamdata generates a setup link and shows it with a copy button.
  4. Select Open to load the link in a new tab and finish the connection. The exact screens differ by provider, so follow the walkthrough for your identity provider.

Once the connection is live, the panel reports that authentication with SAML is enabled.

Treat the setup link like a password

The setup link does not require authentication. Anyone who opens it can configure sign-in for your domain, so do not forward it or paste it into a shared channel.

When SAML is on​

Everyone with an email address on your domain signs in through your identity provider. That includes people you invited before you set SAML up.

Someone who still tries a password is told to use your identity provider instead. Their next attempt through it works.

People with addresses on other domains keep signing in as before.

Turning it off​

Revoke in the panel removes the current configuration after you confirm.

For SAML, this deletes the connection to your identity provider. For Social Login, it removes the provider requirement.

Either way, everyone keeps their Dreamdata account. What changes is how they sign in next time, so make sure everyone has a password or a social login they can use before you revoke.

Revoking SAML does not affect SCIM. Members managed by SCIM stay, and syncing continues, until you turn SCIM off as well.

Troubleshooting​

Dreamdata says the setup did not go through​

You tried to enable a Social Login provider that you are not signed in with. Log out, sign back in with that provider, and try again.

Someone on my team cannot sign in​

Check that their email address is on the domain shown in the panel. Social Login and SAML only apply to that domain. An address on a different domain is not covered by your rule, and signs in with a password or a social provider.

Our identity provider refuses someone on our domain​

Check two things. They must be a member of your Dreamdata account, and they must be assigned to the Dreamdata application in your identity provider.

If they only use a partner's Dreamdata account, invite them to yours with any role. If both things are in place and it still fails, contact support with their email address.

I want to change identity provider​

Revoke the current configuration, then set up the new one. Between the two steps, nobody on your domain can sign in through an identity provider. Do it outside working hours, or make sure people have a password they can use in the meantime.

If something still looks wrong, contact support@dreamdata.io with your account name and the domain you are configuring.

How authentication works underneath​

Dreamdata uses PropelAuth to handle authentication. Their SAML documentation covers the protocol details if you need them for a security review.