Single Sign‐On (SSO) for Columinity

Single Sign-On (SSO) is a technology that allows users to access Columinity with their company accounts. This is more convenient and secure because companies can enforce their log-in policies and manage accounts centrally.

How it works in principle

Single Sign-On basically replaces our authentication process with yours. Typically, when a user logs in, we verify their username and password before they can continue. But with Single Sign-On, this verification process is performed by your company's Identity Provider (IdP). So when a user logs in to Columinity that belongs to your organization (based on their email domain), we basically go to your company's IdP and ask them "Do you know this user?". The IdP then asks the user to perform whatever authentication is needed by your organization. If this passes, the IdP returns a "Yes, we know this user as [someuniquecode]". Because [someuniquecode] is linked to a user account in Columinity, we can then safely assume is that user without performing authentication ourselves.

Important to note:

• The above is a simplified description. Strong cryptographic protocols are followed to ensure a safe login procedure.
• Columinity never has access to your login information (password, hardware keys, MFA, etc).
• If your company account is removed, you can no longer access Columinity.
• SSO has to be configured manually on both ends. It is not available automatically. Contact info@columinity.com for more information.

Requirements

Because Single Sign-On (SSO) requires manual configuration work on both our sides, we require a minimum scale:

• Annual enterprise plan
• A minimum of 25 teams

Supported platforms

Verified with customers:

• OpenID Connect 1.0
• Google Workspace (OpenID Connect)
• Microsoft Entra ID

Supported, but not yet verified with customers:

• SAML 2.0
• OAuth v2
• GitHub / GitLab

Implementation steps

1. We create an Identity Provider integration for your required integration
2. You receive a redirect URL from us
3. You create an integration on your end, using our redirect URL.
4. You provide the domain names for which users should log in with your SSO Provider (typically @yourcompany.com).
5. You provide us with a ClientID / Client Secret (in a secure manner, so not in plain-text email!)
6. We test the connection together
7. Once the tests complete, you can begin enabling SSO for existing user accounts and/or create new accounts.

For EntraID / Azure

1. We need the scopes "openid email profile User.Read".
2. We do not use any role information in the session. Roles are exclusively managed in Columinity.

How to log in with SSO

• Teams Dashboard: Learn how to invite existing users for SSO, and to create new users with SSO, on this page.
• Coaching Center: Learn how to invite existing coaches for SSO, and to create new coaches with SSO, on this page.