Skip to main content

​
Overview

Single Sign-On (SSO) allows your team members to authenticate using your organization’s identity provider (IdP). This provides centralized authentication management and enhanced security.

​
What is SSO?

Single Sign-On allows users to:
BenefitDescription
One PasswordUse existing corporate credentials
Centralized AccessIT controls access from one place
Automatic ProvisioningUsers created automatically on first login
Automatic DeprovisioningAccess revoked when removed from IdP
Enhanced SecurityLeverage your IdP’s security features

​
Supported Identity Providers

Royaltyport supports a wide range of identity providers:
  • Microsoft AD FS
  • PingFederate
  • PingOne
  • CyberArk SAML
  • Oracle
  • Salesforce
  • VMware Workspace One
  • NetIQ SAML
  • ADP (OIDC)
  • CAS SAML
  • ClassLink SAML
  • Cloudflare SAML
  • Clever (OIDC)
  • Keycloak SAML
  • LastPass SAML
  • Login.gov (OIDC)
  • miniOrange SAML
  • Rippling
  • Shibboleth
  • SimpleSAMLphp SAML
  • Custom SAML 2.0
  • Custom OpenID Connect (OIDC)
The setup process varies by identity provider. The onboarding process provides step-by-step instructions specific to your chosen provider during configuration.

​
Enabling SSO

​
Step 1: Add and Verify Your Domain

You must verify at least one domain before configuring an identity provider. The logged-in user must have an email address belonging to the domain they are trying to verify (e.g., to verify yourcompany.com, you must be logged in as user@yourcompany.com).
1

Add Domain

Go to Organization Settings → Security and click Add Domain. Enter your email domain (e.g., yourcompany.com).
2

Open Verification

Click the Verify button next to your domain. This opens a new page with DNS verification instructions.
3

Add DNS Record

Follow the instructions to add a TXT record to your domain’s DNS settings. The exact steps depend on your DNS provider.
4

Wait for Verification

You can wait on the verification page for automatic detection, return to the Security settings page and check periodically, or close the page entirely — all organization admins will receive an email once the domain is verified. DNS changes can take up to 48 hours to propagate.
5

Confirmation

Once verified, the domain status will show Verified and you can proceed to configure your identity provider.
Once an identity provider is activated, verified domains can no longer be changed. Make sure your domain is correct before proceeding.

​
Step 2: Configure Your Identity Provider

After at least one domain is verified, you can configure your identity provider:
  1. Click Configure Provider in the Connection section
  2. This opens the setup portal
  3. Select your identity provider (e.g., Google Workspace, Okta, Azure AD)
  4. Follow the step-by-step instructions provided.
The set-up process guides you through the entire process for your specific provider, including:
  • Creating an application in your IdP
  • Configuring SAML settings
  • Uploading certificates or metadata
  • Testing the connection
Once your identity provider is successfully configured, all organization admins will receive an email confirmation.

​
Step 3: Enable SSO

After your provider is configured and active:
  1. Return to Royaltyport Organization Settings → Security
  2. Toggle Enable SSO to allow SSO sign-in
  3. Members with verified domain emails can now sign in via SSO

​
Step 4: Enforce SSO (Optional)

To require SSO for all users with your domain email:
  1. Toggle Enforce SSO
  2. Password login will be disabled for users with your domain email
  3. New sign-ups from your domain are blocked (must use SSO)
Before enforcing SSO, ensure all users can successfully authenticate through your IdP. Locked out users will need admin assistance.

​
SSO and External Collaborators

SSO is enforced at the organization level. When SSO is enforced:
  • Organization members — All organization members must authenticate via SSO. New organization members cannot be created without SSO.
  • Project team members — External collaborators from other domains can still be invited as project team members. They authenticate with their own credentials (password or their own organization’s SSO).
This allows your organization to maintain strict authentication requirements for internal users while still collaborating with external partners on specific projects.

​
Domain Verification

StatusDescription
PendingVerification in progress
VerifiedDomain ownership confirmed
FailedVerification unsuccessful (check DNS settings or retry)

​
SSO Status

The Security page displays:
FieldDescription
Connection NameThe name of your configured IdP
Connection TypeSAML
StatusActive or Inactive

​
User Experience

​
First-Time SSO Login

  1. User visits Royaltyport login page
  2. Enters email address
  3. Redirected to organization’s IdP
  4. Authenticates with corporate credentials
  5. Redirected back to Royaltyport
  6. Account created automatically or linked to existing account

​
Returning SSO Login

  1. User visits Royaltyport login page
  2. Enters email address
  3. Redirected to IdP (may be instant if already logged in)
  4. Redirected back to Royaltyport, logged in

​
Permission Requirements

ActionRequired Role
View SSO settingsAdmin, Owner
Configure SSOAdmin, Owner
Enable/disable SSOAdmin, Owner
Verify domainAdmin, Owner

​
Troubleshooting

Return to the portal via Configure Provider to check your IdP configuration. Verify the certificate hasn’t expired and that the connection status is Active.
DNS changes can take up to 48 hours to propagate. Verify the TXT record is correctly added to your domain’s DNS settings.
Ensure the user’s email matches a verified domain. They may need to sign in via SSO first to create their account.
Contact Royaltyport support if all Owners are locked out due to SSO issues.