CollectContent Single Sign-On (SSO) lets your team sign in through your organisation's identity provider, such as Okta, Azure AD or Google Workspace, instead of a CollectContent password. It's included on every plan and can be set up by your team's Owner.
Before you start
- You must be the team's Owner to configure Single Sign-On. Administrators and Editors can't access these settings.
- You'll need access to your identity provider's admin console to complete setup.
- You'll need to be able to add a DNS TXT record for your organisation's domain, to prove you own it.
Enabling Single Sign-On
- Open Team Settings by clicking your team name in the global bar.
- Within the team menu select the Team option.
- Scroll down to "Single Sign-On (SAML)" and click Enable Single Sign-On.
- Enter your organisation's email domain (for example
example.com) and click Continue. Public email domains, like Gmail or Outlook, can't be used. - Verify you own the domain by adding the TXT record shown on screen to your DNS settings, then click Check verification once it's had time to propagate. This is usually a few minutes, but can take up to 24-48 hours depending on your provider.
- Connect your identity provider. CollectContent shows you two values to give to your identity provider when you set up the connection on their end:
- SP Entity ID / Metadata URL
- ACS (Assertion Consumer Service) URL
- Once your identity provider gives you its own connection details in return, enter them into CollectContent:
- IdP Entity ID
- IdP Single Sign-On URL
- IdP X.509 Certificate
- Click Save identity provider to finish.
Good to know
You can leave setup partway through and come back later; CollectContent picks up exactly where you left off.
Configuring your identity provider
Most identity providers need you to map user attributes (sometimes called claims) before the connection will work. Configure your identity provider to send the following claims:
| CollectContent field | Claim / attribute URI |
|---|---|
| Primary Email | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress |
| First Name | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname |
| Last Name | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname |
Good to know
Exact steps for configuring claim mappings vary by identity provider. Check your provider's SAML application documentation if you're unsure where to add them.
How sign-in works
Once Single Sign-On is enabled, anyone signing in with an email on your verified domain is automatically redirected to your identity provider instead of entering a CollectContent password, whether they go to sign in or try to register a new account.
- New team members are created automatically the first time they sign in through your identity provider, and are given the Assignee role, unless they already had a pending invitation with a different role, in which case that role is honoured instead. An Owner or Administrator can change their role at any time afterwards. See Roles and Permissions.
- If someone belongs to more than one team, they'll always be sent back through the identity provider that originally authenticated them, even if they've since switched to viewing a different team.
The Owner's password fallback
As the team Owner, you can still sign in with your CollectContent password as a fallback, even once Single Sign-On is enabled, by visiting https://app.collectcontent.co.uk/login?fallback=1. This prevents you from being locked out of your own team if your identity provider is ever unreachable. No other team member can use this fallback.
Disabling Single Sign-On
- Open Team Settings by clicking your team name in the global bar.
- Within the team menu select the Team option.
- Scroll down to "Single Sign-On (SAML)" and click Disable Single Sign-On.
- Confirm your password to finish.
Team members will no longer be redirected to your identity provider. Anyone who only ever signed in through SSO will need to use "Forgot your password?" on the sign-in page to set a password before they can sign in again.