Ctrlk
HomepageChangelogDeveloper
For the complete documentation index, see llms.txt. This page is also available as Markdown.

User authentication with SSO

SSO.

Many organisations may often have existing employee accounts for other services, such as Microsoft and Google.

If that is the case, TilliT can utilise them to manage TilliT users.

Commonly known as Single Sign-On (SSO), you can connect to TilliT with any service using the SAML standard.

SAML is supported by many providers including Microsoft, Amazon (AWS), Google and many others.

We recommend discussing this with a member of the TilliT Support team.

Contact us to discuss using SSO.

Azure Active Directory (Microsoft)

This guide will cover setting up TilliT with Azure Active Directory. Each tenant can now set up Single Sign-On (SSO) directly from Account Settings, allowing secure and streamlined access to the platform through your identity provider.

Click on your avatar on the top-right, choose Account. You will be presented with the Account page interface below. Click on SSO setup and start the SSO Setup.

You will need the provided Entity ID and Reply URL to set this up in Azure.

SSO Setup screen in TilliT showing Step 1 with Identity Entity ID and Reply URL fields.

Open Azure Portal https://portal.azure.com/, on the right side menu choose “Azure Active Directory”.

Azure Active Directory dashboard showing the default directory overview page with Enterprise applications highlighted in the navigation sidebar.

Start the process of creating a new Enterprise application. Select "non-gallery application". Give it a name (TilliT?).

Inside the newly created application, head to Single sign-on and pick SAML.

In the Identifier (Entity ID) and Reply URL, enter the data you've received from the Account page.

Save your changes, it should look like this:

Azure SAML-based Sign-on configuration page displaying Basic SAML Configuration, User Attributes & Claims, and SAML Signing Certificate sections.

Finally, copy the App Federation Metadata URL and paste that into the second step of the setup form in TilliT DO.

SSO Setup screen in TilliT showing Step 2 with an input field to enter the SAML Metadata URL.

In the next steps, the attributes are mapped with some defaults but feel free to edit them.

SSO Setup screen in TilliT showing Step 3 for mapping SAML provider attributes such as email, family_name, and first name.

Finally choose your additional configurations, it is crucial to have the provider enabled

After creation your SSO Setup page will be populated with values like this.

TilliT Your Identity Provider Details page displaying SAML Provider Type, Metadata URL, configured Attribute Mappings, Provider Options set to Enable, and Update Information and Delete buttons.

Just In Time Provisioning

You can model your TilliT Groups and TilliT Roles in your Identity Provider and send them as Group claims in your SAML configuration.

This will take precedence over any role & group assignment performed within TilliT. This means user role and group assignment is now handled by IT or those who manage your IDP.

Example:

Here we have added the groups claim in to our Enterprise Application in Azure. We have modelled our Azure Groups using the “tillit-” prefix and only send those in the SAML claims.

  1. Model your groups within your IDP, ensure you have created all groups and roles.

Azure AD groups table listing tillit-prefixed security groups and their Object IDs.

  1. Add the groups claim to the SSO configuration for your Enterprise Application

Azure SAML additional claims table showing a user.groups claim entry.
Microsoft Entra ID Groups Claims settings filtering security groups by the prefix tillit-.

  1. Contact support and send through the Group Ids like shown in step 1 for all the TilliT groups.

PreviousPermissions
NextNo Site Assigned

Last updated