Skip to main content

Set up Single Sign-On (SSO) for secure authentication

Make logging in simple and secure for your team

Written by Support Team

Introduction

Ledgy’s SAML-based Single Sign-On (SSO) feature allows your users to log in through your identity provider (IdP). This makes logging in simple and secure for your team. Ledgy also supports SCIM.

Company admins can set up SAML SSO themselves. See How do I self-configure SAML Single Sign-On (SSO) in Ledgy?

Note: SSO is only available to customers on the Enterprise plan.

Identity providers we support

Ledgy’s SSO integration has been successfully tested with Okta, Azure AD, Google, OneLogin, and JumpCloud. Other identity providers should also work but aren’t explicitly supported. If you have any issues or requests, please reach out to [email protected]

How SSO is enforced at Ledgy

Ledgy uses SAML 2.0 and supports both Service Provider (SP) and Identity Provider (IdP) initiated flows.

Once SSO is configured and enabled:

  • SSO will be enforced for any user whose stakeholder has an email matching your SSO corporate domain. Stakeholders with an email not matching the domain will not be enforced. This allows external collaborators (such as investors) to retain access.

  • SSO is enforced for all stakeholders matching your domain and cannot be limited to collaborators at this time.

  • Other login methods such as email and password are disabled when SSO is enforced.

  • When SSO is enabled, new users must accept their invitation using the SSO-enforced stakeholder email. Users cannot change certain details such as email, name, and address (these can be synced with the identity provider using SCIM).

  • We can set up custom email-matching, “Allow” or “Exclude” rules that limit SSO enforcement, for example for testing. Talk to your CS Manager if you need this.

  • If a user changes their email and it doesn’t match the SSO-enforced stakeholder email, that user will not have SSO enforced. However, SSO-enforced users cannot change their email, so this is only possible if the user changes their email before SSO is enabled.

  • When SSO is enabled, Ledgy’s native 2FA feature will not be used. If you want to enforce 2FA you can do so through your identity provider.

  • Ledgy can support multiple SSO domains if you want.

Getting started

Setting up SAML SSO takes four steps: verify your email domain, create the Ledgy app in your identity provider, upload its metadata XML in Ledgy, and turn on Require single sign-on (SSO). Follow the self-configure guide for the steps in Ledgy, and use the provider guides below for step 2.

Once you turn on SSO, affected users will receive an email notification telling them that SSO is now enforced.

Your organization slug

Your organization slug is created from the Slug domain you choose in Ledgy’s SSO setup. Dots become dashes, so example.com becomes example-com. Use it wherever <orgSlug> appears below.

The slug can’t be changed once SSO is saved, so choose your slug domain before you configure your identity provider. See Step 2 of the self-configure guide.

Azure AD guide

Ledgy is available as a pre-approved enterprise application in Azure Active Directory (AAD) marketplace.

  1. Follow the setup guide in the Azure marketplace: https://learn.microsoft.com/en-gb/azure/active-directory/saas-apps/ledgy-tutorial

  2. In SAML Certificates, download the Federation Metadata XML file, then upload it in Ledgy (Step 3 of the self-configure guide). Ledgy’s upload takes a file, not a URL.

  3. Turn on Require single sign-on (SSO) in Ledgy (Step 4 of the self-configure guide).

Okta guide

  1. Go to your admin panel and select Applications:

  2. Click Create App Integration:

  3. Select SAML 2.0 and click Next:

  4. Enter “Ledgy” as the App name and click Next:

  5. Fill out the SAML Settings as follows, replacing <orgSlug> with your organizational slug:

    • Single sign-on URL: https://app.ledgy.com/auth/saml/<orgSlug>/acs

    • Audience URI (SP Entity ID): https://app.ledgy.com/auth/saml/<orgSlug>/metadata.xml

  6. Fill out the attribute statements as follows and click Next:

    • id: user.id

    • email: user.email

    • firstName: user.firstName

    • lastName: user.lastName

  7. Fill out the form as follows and click Finish:

  8. From the Sign On tab of your new Ledgy application, click on View IdP metadata, and save the resulting XML file:

  9. From the Assignments tab of your new Ledgy application, assign whoever should have access to Ledgy via SAML SSO:

  10. Upload the XML in Ledgy and turn on SSO (Steps 3–4 of the self-configure guide).

Google guide

  1. From the Google Admin console, navigate to Apps > Web and mobile apps > Add app and then click Add custom SAML app:

  2. Enter “Ledgy” as the App name:

  3. Download the SSO metadata XML file and save it. You’ll upload it to Ledgy later:

  4. Configure the Service provider details as follows:

    • ACS URL: https://app.ledgy.com/auth/saml/<orgSlug>/acs

    • Entity ID: https://app.ledgy.com/auth/saml/<orgSlug>/metadata.xml

    • Signed Response: ****true (we require both signed assertions and responses)

    • Name ID format: ****Email

    • Name ID: Primary Email

  5. Configure the standard Attribute Mapping as follows:

    • First name: firstName

    • Last name: lastName

    • Primary email: email

  6. On the next screen, click User access to assign whoever should have access to Ledgy via SAML SSO

  7. Check ON for everyone and click Save:

  8. Upload the XML in Ledgy and turn on SSO (Steps 3–4 of the self-configure guide).

OneLogin guide

  1. Create a ‘SAML Custom Connector (Advanced)’ Application:

  2. Fill out the SAML Settings as follows, replacing <orgSlug> with the organisational slug:

    • Params:

      • ACS URL: https://app.ledgy.com/auth/saml/<orgSlug>/acs

      • ACS URL Validator: https://app.ledgy.com/auth/saml/<orgSlug>/acs

      • Audience URI (SP Entity ID): https://app.ledgy.com/auth/saml/<orgSlug>/metadata.xml

  3. Fill out the attribute statements as follows:

  4. Fill out the SSO section as follows:

  5. From the ‘More Actions’ dropdown of your new Ledgy application, click on ‘SAML metadata’, download the resulting XML file and upload it in Ledgy (Step 3 of the self-configure guide):

JumpCloud guide

  1. Fill out the Single Sign-On Configuration as follows, replacing <orgSlug> with the organisational slug:

    • Params:

      • IdP Entity ID: https://app.ledgy.com/auth/saml/<orgSlug>/metadata.xml

      • SP Entity ID: https://app.ledgy.com/auth/saml/<orgSlug>/metadata.xml

      • ACS URLs: https://app.ledgy.com/auth/saml/<orgSlug>/acs

      • ACS URL Validator: https://app.ledgy.com/auth/saml/<orgSlug>/acs

      • Signature Algorithm: RSA-SHA256

  2. Fill out the attribute statements as follows:

  3. Click on ‘Export Metadata’, download the resulting XML file and upload it in Ledgy (Step 3 of the self-configure guide).

Setting up with other providers

If you use a different identity provider, you should be able to follow a similar process of setting up a Ledgy app in your provider and uploading the resulting metadata XML file in Ledgy (see the self-configure guide).

OIDC support

Note: Self-service setup only supports SAML. To use OIDC, contact your CS Manager or [email protected].

In addition to SAML, Ledgy also supports OpenID (OIDC), an alternative authentication protocol. When setting up the Ledgy app in your identity provider, choose OIDC instead of SAML.

Okta OIDC

  1. Go to your admin panel and select applications:

  2. Select Create App Integration:

  3. Select OIDC - OpenID Connect and Web Application and click Next:

Related Articles
Did this answer your question?