Zingtree supports Single Sign-on (SSO) as a means of restricting access to trees. Many customers have sensitive corporate processes or procedures encapsulated in their trees, and ensuring these trees are accessible only to certain employees can be invaluable.
Single Sign-on can be enabled with separate login systems for:
- Employees/agents/end-users.
- Tree Authors.
Single Sign-on is a service provided by many vendors, including Okta, Microsoft (ADFS / Active Directory / Azure), Google (G-Suite), Salesforce and more. These services are known as Identity Providers. A single log-in through an Identity Provider gives a user secure, authenticated access to applications provided by Service Providers like Zingtree.
Once you log in through your Identity Provider, you don’t need to re-enter your login credentials. SSO is a very convenient way to secure access to your applications, while not burdening end-users with extra hurdles.
Zingtree supports any service that is SAML 2.0 compliant, which is a common standard.
Set Up Overview
Configuring SSO requires your Identity Provider and Zingtree to share information with each other:
- Your Identity Provider needs information about Zingtree.
- Zingtree needs information about your Identity Provider.
Configuring Zingtree for SSO
To start, in the Zingtree top menu, go to My Team. Here you can configure SSO for Authors, and/or Agents.
You’ll see the parameters (specific to your organization) to share with your Identity Provider. Here’s how the Agent view appears:
Configure your Identity Provider with these parameters.
Next, click the blue button to Enter Identity Provider Data into Zingtree. The following screen appears:
Copy the rest of these settings from your Identity Provider.
Click Save Identity Provider Settings when finished.
SSO just needs to be set up once for your organization.
Testing Your SSO Setup
Once you’ve set up your Identity Provider and Zingtree for SSO, you can test from Zingtree as follows:
- In Zingtree, go to My Team > Single Sign-on > (Agent/Author). The configuration screen appears.
- Click the Test Author Login or Test Agent Login button at the lower right of the page.
From here. you can test logging into your Identity Provider from Zingtree. If you’re already logged in, the test will just return your email or another identifier from your Identity Provider. If you’re not yet logged in, the Identity Provider’s login screen will appear, and then you will be returned to the Zingtree SSO test page after logging in.
Enabling SSO for Agents/Authors
Once SSO is working properly from your test, you can restrict access to any tree as follows.
- From My Team > Single Sign-on > (Agent/Author)
- Tick enable Agents/Authors.
IMPORTANT: You still need to specify individual trees to restrict access to. Here’s how:
- Go to My Trees, and select the tree that you want to require SSO login.
- Go to Settings > Security, and you’ll see something like this:
- Check Require Login via Single Sign-on (SSO).
- Click Update Settings.
Dedicated Agent Login
Rather than having Agents go through the Zingtree login page, you can send them directly to your SSO login page. Here’s how:
- Go to My Team, My Agents.
- Give your agents the link from this button located at the bottom of the page:
One More Step: You also need to add authors to your organization via My Team, My Authors. They will not be required to use a Zingtree login to gain access, but this also validates them as a person who has access to an organization’s trees.
The rest of the setup for sharing information with your identity provider is identical to Agent Setup.