SSO Setup (Enterprise)

Single Sign-On (SSO) allows your team to access DealView using your organization's identity provider.

Supported Providers

DealView supports SAML 2.0 SSO with:

• Okta
• Azure Active Directory
• Google Workspace
• OneLogin
• Ping Identity
• Any SAML 2.0 compliant provider

Before You Begin

You'll need:

• Admin access to your identity provider
• Admin access to your DealView workspace
• Your identity provider's SAML metadata

Configuration Steps

Step 1: Get DealView SAML Details

1. Go to Settings → Security → SSO
2. Click Configure SSO
3. Note the following values:
   • ACS URL (Assertion Consumer Service)
   • Entity ID
   • Start URL

Step 2: Configure Your Identity Provider

In your IdP (example for Okta):

1. Create a new SAML application
2. Enter DealView's ACS URL
3. Enter DealView's Entity ID
4. Configure attribute mappings:
   • email → User's email address
   • firstName → User's first name
   • lastName → User's last name
5. Save and activate the application

Step 3: Complete DealView Setup

1. Return to DealView SSO settings
2. Enter your IdP's metadata URL or upload XML
3. Click Test Connection
4. If successful, click Enable SSO

Attribute Mapping

Required attributes:

Optional attributes:

• department - For team assignment
• role - For automatic role assignment

User Provisioning

Just-In-Time (JIT) Provisioning

New users are created automatically on first SSO login:

• Account created with default Member role
• Assigned to default workspace
• Admin can adjust permissions after

SCIM Provisioning (Enterprise+)

For automated user management:

• User creation/deactivation syncs from IdP
• Group memberships map to DealView roles
• Contact support to enable SCIM

Testing SSO

Before enforcing SSO:

1. Test with a pilot group
2. Verify login works correctly
3. Check role assignments
4. Confirm logout behavior
5. Test on mobile devices

Enforcing SSO

Once tested, enforce SSO-only access:

1. Go to Settings → Security → SSO
2. Enable Require SSO for all users
3. Choose grace period for transition
4. Communicate to your team

After enforcement:

• Password login is disabled
• Users must authenticate via SSO
• Admin bypass remains available

Troubleshooting

Login fails with "Invalid SAML Response"

• Verify ACS URL is correct in your IdP
• Check clock synchronization (SAML is time-sensitive)
• Ensure certificate hasn't expired

User not created after SSO login

• Verify email attribute is mapped correctly
• Check that email domain matches allowed domains
• Review IdP attribute statements

"User already exists" error

• User may have created account before SSO
• Link existing account via Settings → Profile
• Or contact support to merge accounts

IdP-Specific Guides

Okta

1. Create SAML 2.0 app
2. Use "Custom" app template
3. Configure ACS URL and Entity ID
4. Assign users/groups

Azure AD

1. Create Enterprise Application
2. Select "SAML" for SSO method
3. Configure Basic SAML Settings
4. Download Federation Metadata XML

Google Workspace

1. Admin Console → Apps → SAML Apps
2. Add custom SAML app
3. Enter DealView details
4. Configure attribute mapping

Disabling SSO

To revert to password authentication:

1. Go to Settings → Security → SSO
2. Click Disable SSO
3. Users can now set passwords via reset flow