Sign-in methods

DDM knows four ways to sign in. They can be combined – a company can import its staff from Active Directory, let them sign in through its Entra ID, and still invite an external agency with a plain DDM password.

On top of a DDM account or a directory account, people can add a passkey: signing in with a fingerprint, Face ID or the device PIN instead of the password. Whether that is allowed, not allowed or required, the organisation decides under Settings › Security.

Each organisation connects its own identity provider – or several, e.g. one per subsidiary. Two customers on the same DDM installation can both use Entra ID – each with their own tenant – and a third can use Okta by SAML. Nobody has to register DDM centrally for that.

Signing in is not access

Whichever method is used, it only answers who somebody is. Whether they get into an organisation, and what they see there, DDM decides itself: a person needs a membership in the organisation, and their groups decide which categories they see.

A membership comes from one of four places:

• An invitation – an administrator invites the address under Users, see Users.
• The directory service – the import creates the account and the membership and puts the person into groups, see Directory services.
• Single sign-on – if Create accounts on first sign-in is on, the first sign-in creates the account and the membership, and a group mapping puts the person into groups, see Single sign-on.
• Registration – whoever registers the organisation becomes its owner.

Your identity provider only speaks for addresses on your confirmed domains. Even if it reported the address of somebody at another company, DDM would refuse the sign-in.

Your e-mail domains

Under Settings › Organisation › E-mail domains your company's domains are listed (e.g. company.com; sub-domains such as plant.company.com are included). A domain does three things:

• it points colleagues who sign in for the first time to your organisation,
• it decides which addresses are sent to your single sign-on, and
• it allows your directory service and your single sign-on to create accounts and to take over existing accounts with addresses on that domain.

A domain only counts once it is confirmed. The domain of the person who registered the organisation is confirmed as soon as they confirm their e-mail address. A further domain can be added by somebody whose own, confirmed address is at exactly that domain. Domains marked not confirmed have no effect – Claim again confirms them.

Which method does a person use?

The Users list shows each person's Sign-in method: Local (DDM password), the name of the directory they come from, Single sign-on, Microsoft, Google, Okta – or No sign-in if the person has not set anything up yet.

People whose name and e-mail come from a directory or from single sign-on cannot change them under My account – they are maintained at the source.

What the sign-in page does

The sign-in page has one field for the e-mail and one for the password. As soon as somebody has typed their e-mail address, DDM checks whether their organisation uses single sign-on – if so, the button Continue with … appears with the name your administrator chose, one for each provider responsible for the domain. Otherwise DDM first checks the DDM password and, if that does not fit, asks the directory services. That is why the hint LDAP accounts: use your company password is under the password field – the person does not have to choose.

If your organisation requires single sign-on, the password field disappears for your addresses. Owners can still show it with Sign in with a password instead – see Require single sign-on.