[{"data":1,"prerenderedAt":1815},["ShallowReactive",2],{"navigation_docs_en":3,"-en-sign-in-and-directories-single-sign-on":427,"-en-sign-in-and-directories-single-sign-on-surround":1810},[4,31,117,188,238,271,310,369,378],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":30},"Getting started","i-hugeicons-rocket-01","\u002Fen\u002Fgetting-started","en\u002F01.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"What is DDM?","\u002Fen\u002Fgetting-started\u002Fwhat-is-ddm","en\u002F01.getting-started\u002F01.what-is-ddm","i-hugeicons-information-circle",{"title":16,"path":17,"stem":18,"icon":19},"Account and sign-in","\u002Fen\u002Fgetting-started\u002Fsign-in","en\u002F01.getting-started\u002F02.sign-in","i-hugeicons-key-01",{"title":21,"path":22,"stem":23,"icon":24},"AI in DDM","\u002Fen\u002Fgetting-started\u002Fai-in-ddm","en\u002F01.getting-started\u002F03.ai-in-ddm","i-hugeicons-ai-magic",{"title":26,"path":27,"stem":28,"icon":29},"System status","\u002Fen\u002Fgetting-started\u002Fsystem-status","en\u002F01.getting-started\u002F04.system-status","i-hugeicons-activity-03",false,{"title":32,"icon":33,"path":34,"stem":35,"children":36,"page":30},"CMS","i-hugeicons-dashboard-square-01","\u002Fen\u002Fcms","en\u002F02.cms",[37,42,47,52,57,62,67,72,77,82,87,92,97,102,107,112],{"title":38,"path":39,"stem":40,"icon":41},"The CMS at a glance","\u002Fen\u002Fcms\u002Foverview","en\u002F02.cms\u002F01.overview","i-hugeicons-compass-01",{"title":43,"path":44,"stem":45,"icon":46},"Uploading documents","\u002Fen\u002Fcms\u002Fupload","en\u002F02.cms\u002F02.upload","i-hugeicons-upload-01",{"title":48,"path":49,"stem":50,"icon":51},"Categories","\u002Fen\u002Fcms\u002Fcategories","en\u002F02.cms\u002F03.categories","i-hugeicons-folder-tree",{"title":53,"path":54,"stem":55,"icon":56},"Editing documents","\u002Fen\u002Fcms\u002Fdocuments","en\u002F02.cms\u002F04.documents","i-hugeicons-file-edit",{"title":58,"path":59,"stem":60,"icon":61},"Searching and filtering","\u002Fen\u002Fcms\u002Fsearch-and-filters","en\u002F02.cms\u002F05.search-and-filters","i-hugeicons-search-01",{"title":63,"path":64,"stem":65,"icon":66},"Groups and permissions","\u002Fen\u002Fcms\u002Fgroups-and-permissions","en\u002F02.cms\u002F06.groups-and-permissions","i-hugeicons-user-multiple",{"title":68,"path":69,"stem":70,"icon":71},"Users","\u002Fen\u002Fcms\u002Fusers","en\u002F02.cms\u002F07.users","i-hugeicons-user-add-01",{"title":73,"path":74,"stem":75,"icon":76},"Approvals","\u002Fen\u002Fcms\u002Fapprovals","en\u002F02.cms\u002F08.approvals","i-hugeicons-checkmark-badge-01",{"title":78,"path":79,"stem":80,"icon":81},"Markets and translations","\u002Fen\u002Fcms\u002Fmarkets-and-translations","en\u002F02.cms\u002F09.markets-and-translations","i-hugeicons-globe-02",{"title":83,"path":84,"stem":85,"icon":86},"Note templates","\u002Fen\u002Fcms\u002Fnote-templates","en\u002F02.cms\u002F10.note-templates","i-hugeicons-layout-01",{"title":88,"path":89,"stem":90,"icon":91},"Usage and audit log","\u002Fen\u002Fcms\u002Fusage-and-audit","en\u002F02.cms\u002F11.usage-and-audit","i-hugeicons-chart-column",{"title":93,"path":94,"stem":95,"icon":96},"AI assistant","\u002Fen\u002Fcms\u002Fassistant","en\u002F02.cms\u002F12.assistant","i-hugeicons-sparkles",{"title":98,"path":99,"stem":100,"icon":101},"Settings","\u002Fen\u002Fcms\u002Fsettings","en\u002F02.cms\u002F13.settings","i-hugeicons-settings-02",{"title":103,"path":104,"stem":105,"icon":106},"Plans","\u002Fen\u002Fcms\u002Fplans","en\u002F02.cms\u002F14.plans","i-hugeicons-package",{"title":108,"path":109,"stem":110,"icon":111},"Feature requests","\u002Fen\u002Fcms\u002Ffeature-requests","en\u002F02.cms\u002F15.feature-requests","i-hugeicons-idea-01",{"title":113,"path":114,"stem":115,"icon":116},"Report a bug","\u002Fen\u002Fcms\u002Fbug-reports","en\u002F02.cms\u002F16.bug-reports","i-hugeicons-bug-01",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":30},"App","i-hugeicons-smart-phone-01","\u002Fen\u002Fapp","en\u002F03.app",[123,128,133,138,143,147,152,157,162,167,170,173,176,179,184],{"title":124,"path":125,"stem":126,"icon":127},"Signing in and finding your way","\u002Fen\u002Fapp\u002Foverview","en\u002F03.app\u002F01.overview","i-hugeicons-login-03",{"title":129,"path":130,"stem":131,"icon":132},"Tabs and split view","\u002Fen\u002Fapp\u002Ftabs","en\u002F03.app\u002F02.tabs","i-hugeicons-layout-2-column",{"title":134,"path":135,"stem":136,"icon":137},"Finding and reading documents","\u002Fen\u002Fapp\u002Fdocuments","en\u002F03.app\u002F03.documents","i-hugeicons-file-01",{"title":139,"path":140,"stem":141,"icon":142},"Favorites","\u002Fen\u002Fapp\u002Ffavorites","en\u002F03.app\u002F04.favorites","i-hugeicons-favourite",{"title":144,"path":145,"stem":146,"icon":61},"Searching","\u002Fen\u002Fapp\u002Fsearch","en\u002F03.app\u002F05.search",{"title":148,"path":149,"stem":150,"icon":151},"Notes","\u002Fen\u002Fapp\u002Fnotes","en\u002F03.app\u002F06.notes","i-hugeicons-note-edit",{"title":153,"path":154,"stem":155,"icon":156},"Calendar and appointments","\u002Fen\u002Fapp\u002Fcalendar","en\u002F03.app\u002F07.calendar","i-hugeicons-calendar-03",{"title":158,"path":159,"stem":160,"icon":161},"Sending to customers","\u002Fen\u002Fapp\u002Foutbox","en\u002F03.app\u002F08.outbox","i-hugeicons-sent",{"title":163,"path":164,"stem":165,"icon":166},"Working offline","\u002Fen\u002Fapp\u002Foffline","en\u002F03.app\u002F09.offline","i-hugeicons-wifi-off-01",{"title":93,"path":168,"stem":169,"icon":96},"\u002Fen\u002Fapp\u002Fassistant","en\u002F03.app\u002F10.assistant",{"title":98,"path":171,"stem":172,"icon":101},"\u002Fen\u002Fapp\u002Fsettings","en\u002F03.app\u002F11.settings",{"title":108,"path":174,"stem":175,"icon":111},"\u002Fen\u002Fapp\u002Ffeature-requests","en\u002F03.app\u002F12.feature-requests",{"title":113,"path":177,"stem":178,"icon":116},"\u002Fen\u002Fapp\u002Fbug-reports","en\u002F03.app\u002F13.bug-reports",{"title":180,"path":181,"stem":182,"icon":183},"Desktop app","\u002Fen\u002Fapp\u002Fdesktop-app","en\u002F03.app\u002F14.desktop-app","i-hugeicons-computer",{"title":185,"path":186,"stem":187,"icon":119},"Mobile app","\u002Fen\u002Fapp\u002Fmobile-app","en\u002F03.app\u002F15.mobile-app",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":30},"Sign-in & directories","i-hugeicons-security-check","\u002Fen\u002Fsign-in-and-directories","en\u002F04.sign-in-and-directories",[194,198,202,207,212,217,222,226,230,234],{"title":195,"path":196,"stem":197,"icon":19},"Sign-in methods","\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods","en\u002F04.sign-in-and-directories\u002F01.sign-in-methods",{"title":199,"path":200,"stem":201,"icon":190},"Single sign-on","\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on","en\u002F04.sign-in-and-directories\u002F02.single-sign-on",{"title":203,"path":204,"stem":205,"icon":206},"Directory services (LDAP)","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-services","en\u002F04.sign-in-and-directories\u002F03.directory-services","i-hugeicons-hierarchy",{"title":208,"path":209,"stem":210,"icon":211},"Synchronisation and sign-in","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync","en\u002F04.sign-in-and-directories\u002F04.directory-sync","i-hugeicons-refresh",{"title":213,"path":214,"stem":215,"icon":216},"Microsoft Entra ID","\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id","en\u002F04.sign-in-and-directories\u002F05.microsoft-entra-id","i-hugeicons-building-03",{"title":218,"path":219,"stem":220,"icon":221},"Okta","\u002Fen\u002Fsign-in-and-directories\u002Fokta","en\u002F04.sign-in-and-directories\u002F06.okta","i-hugeicons-finger-print",{"title":223,"path":224,"stem":225,"icon":81},"Google Workspace","\u002Fen\u002Fsign-in-and-directories\u002Fgoogle-workspace","en\u002F04.sign-in-and-directories\u002F07.google-workspace",{"title":227,"path":228,"stem":229,"icon":119},"Two-factor authentication","\u002Fen\u002Fsign-in-and-directories\u002Ftwo-factor-authentication","en\u002F04.sign-in-and-directories\u002F08.two-factor-authentication",{"title":231,"path":232,"stem":233,"icon":221},"Passkeys","\u002Fen\u002Fsign-in-and-directories\u002Fpasskeys","en\u002F04.sign-in-and-directories\u002F09.passkeys",{"title":235,"path":236,"stem":237,"icon":156},"Calendar access","\u002Fen\u002Fsign-in-and-directories\u002Fcalendar-access","en\u002F04.sign-in-and-directories\u002F10.calendar-access",{"title":239,"icon":240,"path":241,"stem":242,"children":243,"page":30},"MCP server","i-hugeicons-ai-network","\u002Fen\u002Fmcp-server","en\u002F05.mcp-server",[244,248,253,257,262,266],{"title":245,"path":246,"stem":247,"icon":240},"Overview","\u002Fen\u002Fmcp-server\u002Foverview","en\u002F05.mcp-server\u002F01.overview",{"title":249,"path":250,"stem":251,"icon":252},"Setup","\u002Fen\u002Fmcp-server\u002Fsetup","en\u002F05.mcp-server\u002F02.setup","i-hugeicons-plug-socket",{"title":254,"path":255,"stem":256,"icon":111},"What you can do with it","\u002Fen\u002Fmcp-server\u002Fuse-cases","en\u002F05.mcp-server\u002F03.use-cases",{"title":258,"path":259,"stem":260,"icon":261},"Tools","\u002Fen\u002Fmcp-server\u002Ftools","en\u002F05.mcp-server\u002F04.tools","i-hugeicons-wrench-01",{"title":263,"path":264,"stem":265,"icon":76},"Approving changes","\u002Fen\u002Fmcp-server\u002Fapproving-changes","en\u002F05.mcp-server\u002F05.approving-changes",{"title":267,"path":268,"stem":269,"icon":270},"Administration & security","\u002Fen\u002Fmcp-server\u002Fadmin-and-security","en\u002F05.mcp-server\u002F06.admin-and-security","i-hugeicons-shield-key",{"title":272,"icon":273,"path":274,"stem":275,"children":276,"page":30},"External sources","i-hugeicons-database-sync","\u002Fen\u002Fexternal-sources","en\u002F06.external-sources",[277,280,285,290,295,300,305],{"title":245,"path":278,"stem":279,"icon":273},"\u002Fen\u002Fexternal-sources\u002Foverview","en\u002F06.external-sources\u002F01.overview",{"title":281,"path":282,"stem":283,"icon":284},"SharePoint","\u002Fen\u002Fexternal-sources\u002Fsharepoint","en\u002F06.external-sources\u002F02.sharepoint","i-hugeicons-microsoft",{"title":286,"path":287,"stem":288,"icon":289},"OneDrive","\u002Fen\u002Fexternal-sources\u002Fonedrive","en\u002F06.external-sources\u002F03.onedrive","i-hugeicons-folder-cloud",{"title":291,"path":292,"stem":293,"icon":294},"Google Drive","\u002Fen\u002Fexternal-sources\u002Fgoogle-drive","en\u002F06.external-sources\u002F04.google-drive","i-hugeicons-google-drive",{"title":296,"path":297,"stem":298,"icon":299},"FTP \u002F SFTP","\u002Fen\u002Fexternal-sources\u002Fftp-sftp","en\u002F06.external-sources\u002F05.ftp-sftp","i-hugeicons-server-stack-01",{"title":301,"path":302,"stem":303,"icon":304},"REST interface","\u002Fen\u002Fexternal-sources\u002Frest","en\u002F06.external-sources\u002F06.rest","i-hugeicons-api",{"title":306,"path":307,"stem":308,"icon":309},"SOAP interface","\u002Fen\u002Fexternal-sources\u002Fsoap","en\u002F06.external-sources\u002F07.soap","i-hugeicons-source-code",{"title":311,"icon":304,"path":312,"stem":313,"children":314,"page":30},"Integration API","\u002Fen\u002Fintegration-api","en\u002F07.integration-api",[315,318,322,327,332,337,341,346,350,354,359,364],{"title":245,"path":316,"stem":317,"icon":14},"\u002Fen\u002Fintegration-api\u002Foverview","en\u002F07.integration-api\u002F01.overview",{"title":319,"path":320,"stem":321,"icon":19},"Authentication","\u002Fen\u002Fintegration-api\u002Fauthentication","en\u002F07.integration-api\u002F02.authentication",{"title":323,"path":324,"stem":325,"icon":326},"Conventions","\u002Fen\u002Fintegration-api\u002Fconventions","en\u002F07.integration-api\u002F03.conventions","i-hugeicons-book-open-01",{"title":328,"path":329,"stem":330,"icon":331},"Pushing documents","\u002Fen\u002Fintegration-api\u002Fpushing-documents","en\u002F07.integration-api\u002F04.pushing-documents","i-hugeicons-upload-02",{"title":333,"path":334,"stem":335,"icon":336},"Consuming content","\u002Fen\u002Fintegration-api\u002Fconsuming-content","en\u002F07.integration-api\u002F05.consuming-content","i-hugeicons-download-02",{"title":338,"path":339,"stem":340,"icon":137},"Reference: documents","\u002Fen\u002Fintegration-api\u002Freference-documents","en\u002F07.integration-api\u002F06.reference-documents",{"title":342,"path":343,"stem":344,"icon":345},"Reference: categories, tags, markets","\u002Fen\u002Fintegration-api\u002Freference-categories-tags","en\u002F07.integration-api\u002F07.reference-categories-tags","i-hugeicons-folder-01",{"title":347,"path":348,"stem":349,"icon":211},"Reference: sync manifest","\u002Fen\u002Fintegration-api\u002Freference-sync","en\u002F07.integration-api\u002F08.reference-sync",{"title":351,"path":352,"stem":353,"icon":309},"OpenAPI","\u002Fen\u002Fintegration-api\u002Fopenapi","en\u002F07.integration-api\u002F09.openapi",{"title":355,"path":356,"stem":357,"icon":358},"Changelog","\u002Fen\u002Fintegration-api\u002Fchangelog","en\u002F07.integration-api\u002F10.changelog","i-hugeicons-time-schedule",{"title":360,"path":361,"stem":362,"icon":363},"Reference: groups, markets, access","\u002Fen\u002Fintegration-api\u002Freference-groups-access","en\u002F07.integration-api\u002F11.reference-groups-access","i-hugeicons-user-lock-01",{"title":365,"path":366,"stem":367,"icon":368},"Moving from CMWS","\u002Fen\u002Fintegration-api\u002Fcmws","en\u002F07.integration-api\u002F12.cmws","i-hugeicons-arrow-reload-horizontal",{"title":370,"icon":371,"path":372,"stem":373,"children":374,"page":30},"What's new","i-hugeicons-gift","\u002Fen\u002Fwhats-new","en\u002F08.whats-new",[375],{"title":355,"path":376,"stem":377,"icon":358},"\u002Fen\u002Fwhats-new\u002Fchangelog","en\u002F08.whats-new\u002F01.changelog",{"title":379,"icon":299,"path":380,"stem":381,"children":382,"page":30},"Self-hosting","\u002Fen\u002Fself-hosting","en\u002F09.self-hosting",[383,386,390,395,399,404,408,413,418,422],{"title":245,"path":384,"stem":385,"icon":14},"\u002Fen\u002Fself-hosting\u002Foverview","en\u002F09.self-hosting\u002F01.overview",{"title":387,"path":388,"stem":389,"icon":106},"Docker Compose","\u002Fen\u002Fself-hosting\u002Fdocker-compose","en\u002F09.self-hosting\u002F02.docker-compose",{"title":391,"path":392,"stem":393,"icon":394},"Kubernetes","\u002Fen\u002Fself-hosting\u002Fkubernetes","en\u002F09.self-hosting\u002F03.kubernetes","i-hugeicons-cloud",{"title":396,"path":397,"stem":398,"icon":101},"Configuration","\u002Fen\u002Fself-hosting\u002Fconfiguration","en\u002F09.self-hosting\u002F04.configuration",{"title":400,"path":401,"stem":402,"icon":403},"Licence","\u002Fen\u002Fself-hosting\u002Flicence","en\u002F09.self-hosting\u002F05.licence","i-hugeicons-license",{"title":405,"path":406,"stem":407,"icon":211},"Updates","\u002Fen\u002Fself-hosting\u002Fupdates","en\u002F09.self-hosting\u002F06.updates",{"title":409,"path":410,"stem":411,"icon":412},"Postgres","\u002Fen\u002Fself-hosting\u002Fpostgres","en\u002F09.self-hosting\u002F07.postgres","i-hugeicons-database",{"title":414,"path":415,"stem":416,"icon":417},"Backups","\u002Fen\u002Fself-hosting\u002Fbackups","en\u002F09.self-hosting\u002F08.backups","i-hugeicons-database-restore",{"title":419,"path":420,"stem":421,"icon":261},"Troubleshooting","\u002Fen\u002Fself-hosting\u002Ftroubleshooting","en\u002F09.self-hosting\u002F09.troubleshooting",{"title":423,"path":424,"stem":425,"icon":426},"Firewall","\u002Fen\u002Fself-hosting\u002Ffirewall","en\u002F09.self-hosting\u002F10.firewall","i-hugeicons-firewall",{"id":428,"title":199,"body":429,"description":1803,"extension":1804,"links":1805,"meta":1806,"navigation":1807,"path":200,"seo":1808,"stem":201,"__hash__":1809},"docs_en\u002Fen\u002F04.sign-in-and-directories\u002F02.single-sign-on.md",{"type":430,"value":431,"toc":1779},"minimark",[432,471,480,492,497,522,530,534,557,561,577,640,647,653,657,660,664,697,708,725,728,735,779,794,797,811,815,818,891,897,967,978,981,988,1055,1065,1070,1076,1083,1087,1092,1207,1211,1217,1252,1258,1263,1274,1278,1285,1309,1315,1318,1400,1403,1432,1442,1445,1451,1485,1488,1491,1495,1510,1520,1524,1527,1598,1605,1609,1695,1699,1711,1725,1729],[433,434,435,436,439,440,439,442,439,444,439,447,439,450,439,453,439,456,439,459,462,463,466,467,470],"p",{},"With single sign-on, your people sign in to the CMS and the app with the account your company already manages – in ",[437,438,213],"strong",{},", ",[437,441,218],{},[437,443,223],{},[437,445,446],{},"Keycloak",[437,448,449],{},"Auth0",[437,451,452],{},"OneLogin",[437,454,455],{},"JumpCloud",[437,457,458],{},"ADFS",[437,460,461],{},"Shibboleth"," or any other provider that speaks ",[437,464,465],{},"OpenID Connect"," or ",[437,468,469],{},"SAML 2.0",". Your provider's multi-factor authentication and access policies apply. DDM never sees their password.",[433,472,473,474,476,477,479],{},"You set it up yourself, for your organisation only, in the CMS under ",[437,475,98],{}," › ",[437,478,199],{},". Only owners see it: whoever sets up the provider decides who signs in as whom – owners included.",[481,482,483,484,487,488,491],"note",{},"Available from the ",[437,485,486],{},"Enterprise"," plan – see ",[489,490,103],"a",{"href":104},".",[493,494,496],"h2",{"id":495},"how-it-works","How it works",[498,499,500,516,519],"ol",{},[501,502,503,504,507,508,511],"li",{},"Somebody types their e-mail address on the sign-in page. DDM recognises your domain and shows ",[437,505,506],{},"Continue with …"," – one button for each of your providers that is responsible for the domain.",[509,510],"br",{},[512,513],"img",{"alt":514,"src":515},"The sign-in page with the single sign-on button","\u002Fscreens\u002Fen\u002Fdocs-sso-login.webp",[501,517,518],{},"A click takes them to your provider, where they sign in as usual – with MFA, if your provider asks for it.",[501,520,521],{},"Your provider sends them back. DDM checks the answer, signs them in – into your organisation – and, if you map groups, puts them into the right groups.",[433,523,524,525,529],{},"DDM only lets in people whose address is on one of ",[489,526,528],{"href":527},"\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods#your-e-mail-domains","your confirmed domains",". Somebody who is not yet in DDM gets an account on their first sign-in – unless you switch that off.",[493,531,533],{"id":532},"what-you-need","What you need",[535,536,537,543],"ul",{},[501,538,539,542],{},[437,540,541],{},"An administrator of your identity provider"," who can register an application there.",[501,544,545,548,549,476,551,476,554,491],{},[437,546,547],{},"A confirmed e-mail domain"," in DDM, under ",[437,550,98],{},[437,552,553],{},"Organisation",[437,555,556],{},"E-mail domains",[493,558,560],{"id":559},"_1-add-your-provider","1. Add your provider",[433,562,563,564,476,566,568,569,572,573,576],{},"Open ",[437,565,98],{},[437,567,199],{}," and click ",[437,570,571],{},"New identity provider"," at the top right. In ",[437,574,575],{},"Add identity provider",", choose:",[578,579,580,593],"table",{},[581,582,583],"thead",{},[584,585,586,590],"tr",{},[587,588,589],"th",{},"Field",[587,591,592],{},"What to choose",[594,595,596,611,625],"tbody",{},[584,597,598,604],{},[599,600,601],"td",{},[437,602,603],{},"Provider",[599,605,606,607,610],{},"Microsoft Entra ID, Okta, Google Workspace or ",[437,608,609],{},"Other",". It decides the icon on the button and the hints on the page – nothing else.",[584,612,613,618],{},[599,614,615],{},[437,616,617],{},"Protocol",[599,619,620,466,622,624],{},[437,621,465],{},[437,623,469],{},". If your provider can do both, OpenID Connect is quicker to set up. Choose SAML if your security team prefers it, if your provider only speaks SAML (ADFS, Shibboleth) – or for Google Workspace, if you want to map groups.",[584,626,627,632],{},[599,628,629],{},[437,630,631],{},"Button label",[599,633,634,635,639],{},"What the button on the sign-in page says: „Continue with ",[636,637,638],"em",{},"Company sign-in","\". Use a name your people recognise, e.g. „Halden Microsoft\".",[433,641,642,643,646],{},"Click ",[437,644,645],{},"Add",". The provider is created switched off – you can set it up at your leisure. Its button label is at the top of the provider; to change it later, type there and click elsewhere – it is saved as soon as you leave the field.",[433,648,649],{},[512,650],{"alt":651,"src":652},"Settings › Single sign-on","\u002Fscreens\u002Fen\u002Fdocs-cms-sso-setup.webp",[493,654,656],{"id":655},"_2-register-ddm-with-your-provider","2. Register DDM with your provider",[433,658,659],{},"What your provider needs from DDM depends on the protocol.",[661,662,465],"h3",{"id":663},"openid-connect",[433,665,666,667,669,670,673,674,677,678,681,682,466,685,688,689,692,693,696],{},"In your provider, create an application of the type ",[437,668,465],{}," \u002F ",[437,671,672],{},"Web application"," with the ",[437,675,676],{},"Authorization Code"," flow and a ",[437,679,680],{},"client secret",", and register as its redirect URI (also called ",[636,683,684],{},"callback URL",[636,686,687],{},"sign-in redirect URI",") the ",[437,690,691],{},"Redirect URI"," from the card ",[437,694,695],{},"Before you start",". It is the same for every organisation and every provider:",[698,699,705],"pre",{"className":700,"code":702,"language":703,"meta":704},[701],"language-text","https:\u002F\u002Fcms.documentdistributionmanager.com\u002Fapi\u002Fauth\u002Fsso\u002Fcallback\n","text","",[706,707,702],"code",{"__ignoreMap":704},[433,709,710,711,714,715,718,719,722,723,491],{},"DDM asks for the scopes ",[706,712,713],{},"openid email profile","; most providers grant them by default. Your provider then gives you three things: the ",[437,716,717],{},"issuer",", a ",[437,720,721],{},"client ID"," and a ",[437,724,680],{},[661,726,469],{"id":727},"saml-20",[433,729,730,731,734],{},"In your provider, create a ",[437,732,733],{},"SAML"," application and enter the three values DDM shows for this provider – each has a copy button:",[578,736,737,747],{},[581,738,739],{},[584,740,741,744],{},[587,742,743],{},"DDM shows",[587,745,746],{},"Your provider calls it",[594,748,749,759,769],{},[584,750,751,756],{},[599,752,753],{},[437,754,755],{},"Identifier (Entity ID)",[599,757,758],{},"Identifier, Entity ID, Audience URI, SP Entity ID",[584,760,761,766],{},[599,762,763],{},[437,764,765],{},"Reply URL (ACS URL)",[599,767,768],{},"Reply URL, Assertion Consumer Service URL, Single sign-on URL",[584,770,771,776],{},[599,772,773],{},[437,774,775],{},"DDM's metadata",[599,777,778],{},"Some providers read the two values above from this address instead.",[433,780,781,782,785,786,789,790,793],{},"Unlike the redirect URI, these are ",[437,783,784],{},"different for every provider"," – they contain its ID. Have your provider send the e-mail address as an attribute (or as the ",[636,787,788],{},"Name ID",") and, if you want to map groups, the groups. Your provider then gives you its ",[437,791,792],{},"metadata"," – usually as a URL.",[433,795,796],{},"Step-by-step guides for both protocols:",[535,798,799,803,807],{},[501,800,801],{},[489,802,213],{"href":214},[501,804,805],{},[489,806,218],{"href":219},[501,808,809],{},[489,810,223],{"href":224},[493,812,814],{"id":813},"_3-enter-your-provider-in-ddm","3. Enter your provider in DDM",[661,816,465],{"id":817},"openid-connect-1",[578,819,820,829],{},[581,821,822],{},[584,823,824,826],{},[587,825,589],{},[587,827,828],{},"What to enter",[594,830,831,841,851,861,875],{},[584,832,833,838],{},[599,834,835],{},[437,836,837],{},"Issuer",[599,839,840],{},"The provider's address – see the table below.",[584,842,843,848],{},[599,844,845],{},[437,846,847],{},"Client ID",[599,849,850],{},"From your provider.",[584,852,853,858],{},[599,854,855],{},[437,856,857],{},"Client secret",[599,859,860],{},"From your provider. It is stored encrypted and never shown again.",[584,862,863,868],{},[599,864,865],{},[437,866,867],{},"E-mail claim",[599,869,870,871,874],{},"Where the provider puts the e-mail address. Leave it at ",[706,872,873],{},"email"," unless your provider's guide says otherwise.",[584,876,877,882],{},[599,878,879],{},[437,880,881],{},"Scopes",[599,883,884,886,887,890],{},[706,885,713],{}," are always requested. Add more separated by spaces – e.g. ",[706,888,889],{},"groups",", if your provider sends groups only for it.",[433,892,642,893,896],{},[437,894,895],{},"Save",". DDM reads your provider's configuration straight away – if the issuer is wrong, you get an error here, not when the first person signs in.",[578,898,899,907],{},[581,900,901],{},[584,902,903,905],{},[587,904,603],{},[587,906,837],{},[594,908,909,918,931,940,949,958],{},[584,910,911,913],{},[599,912,213],{},[599,914,915],{},[706,916,917],{},"https:\u002F\u002Flogin.microsoftonline.com\u002F\u003Ctenant ID>\u002Fv2.0",[584,919,920,922],{},[599,921,218],{},[599,923,924,927,928],{},[706,925,926],{},"https:\u002F\u002F\u003Cyour org>.okta.com"," – or with a custom authorisation server ",[706,929,930],{},"https:\u002F\u002F\u003Cyour org>.okta.com\u002Foauth2\u002Fdefault",[584,932,933,935],{},[599,934,223],{},[599,936,937],{},[706,938,939],{},"https:\u002F\u002Faccounts.google.com",[584,941,942,944],{},[599,943,446],{},[599,945,946],{},[706,947,948],{},"https:\u002F\u002F\u003Cserver>\u002Frealms\u002F\u003Crealm>",[584,950,951,953],{},[599,952,449],{},[599,954,955],{},[706,956,957],{},"https:\u002F\u002F\u003Cyour tenant>.auth0.com\u002F",[584,959,960,962],{},[599,961,458],{},[599,963,964],{},[706,965,966],{},"https:\u002F\u002F\u003Cserver>\u002Fadfs",[968,969,970,971,974,975,977],"tip",{},"The issuer is the address under which your provider publishes ",[706,972,973],{},"\u002F.well-known\u002Fopenid-configuration",". If you are unsure, open that address in a browser – the value of ",[706,976,717],{}," in it is exactly what DDM needs.",[661,979,469],{"id":980},"saml-20-1",[433,982,983,984,987],{},"Under ",[437,985,986],{},"Your provider's metadata",", choose how DDM gets it:",[578,989,990,1000],{},[581,991,992],{},[584,993,994,997],{},[587,995,996],{},"Choice",[587,998,999],{},"When",[594,1001,1002,1019,1029],{},[584,1003,1004,1009],{},[599,1005,1006],{},[437,1007,1008],{},"Metadata URL",[599,1010,1011,1012,1015,1016,1018],{},"Your provider publishes its metadata at an address – Entra ID's ",[636,1013,1014],{},"App Federation Metadata Url",", Okta's ",[636,1017,1008],{},". The best choice: DDM can reload it when your provider changes its certificate.",[584,1020,1021,1026],{},[599,1022,1023],{},[437,1024,1025],{},"Paste metadata",[599,1027,1028],{},"You downloaded the metadata as an XML file – e.g. from Google. Paste its content.",[584,1030,1031,1036],{},[599,1032,1033],{},[437,1034,1035],{},"Enter by hand",[599,1037,1038,1039,1042,1043,1046,1047,1050,1051,1054],{},"Your provider shows the values individually: its ",[437,1040,1041],{},"Entity ID",", its ",[437,1044,1045],{},"sign-in URL"," (SSO URL) and its ",[437,1048,1049],{},"signing certificate"," (PEM, ",[706,1052,1053],{},"-----BEGIN CERTIFICATE-----",").",[433,1056,1057,1058,1061,1062,1064],{},"Also check the ",[437,1059,1060],{},"E-mail attribute",": the name of the attribute that holds the address. DDM suggests what your provider usually sends; if the attribute is missing, the ",[636,1063,788],{}," is used as the address.",[433,1066,642,1067,1069],{},[437,1068,895],{},". DDM reads the metadata straight away and shows your provider's Entity ID and how long its certificate is valid. Metadata without a usable sign-in URL or with an expired certificate is refused here.",[433,1071,1072],{},[512,1073],{"alt":1074,"src":1075},"A SAML provider: DDM's values and your provider's","\u002Fscreens\u002Fen\u002Fdocs-cms-sso-saml.webp",[481,1077,1078,1079,1082],{},"DDM sends the sign-in request by HTTP redirect and does not sign it; your provider signs its answer – the whole response or the assertion – and DDM checks the signature against the certificate in the metadata. Encrypted assertions are not supported. Sign-in that starts at your provider (a tile in ",[636,1080,1081],{},"My Apps"," or the Okta dashboard) is not supported either: people start on DDM's sign-in page.",[661,1084,1086],{"id":1085},"test-connection","Test connection",[433,1088,642,1089,1091],{},[437,1090,1086],{},":",[578,1093,1094,1104],{},[581,1095,1096],{},[584,1097,1098,1101],{},[587,1099,1100],{},"Message",[587,1102,1103],{},"Meaning",[594,1105,1106,1116,1126,1140,1150,1160,1174,1184,1197],{},[584,1107,1108,1113],{},[599,1109,1110],{},[437,1111,1112],{},"The provider answers and accepted the client ID and secret.",[599,1114,1115],{},"All good.",[584,1117,1118,1123],{},[599,1119,1120],{},[437,1121,1122],{},"The provider answers. Whether the client secret is right shows at the first sign-in",[599,1124,1125],{},"Many providers do not let DDM check the secret in advance. Sign in once yourself to be sure – see below.",[584,1127,1128,1133],{},[599,1129,1130],{},[437,1131,1132],{},"The provider rejected the client ID or the secret.",[599,1134,1135,1136,1139],{},"Copy both again – in Entra ID the secret's ",[437,1137,1138],{},"Value",", not its ID.",[584,1141,1142,1147],{},[599,1143,1144],{},[437,1145,1146],{},"The provider does not answer",[599,1148,1149],{},"Check the issuer. A provider on your own network has to be allowed by whoever runs DDM.",[584,1151,1152,1157],{},[599,1153,1154],{},[437,1155,1156],{},"There is no discovery document under this issuer",[599,1158,1159],{},"The issuer is not quite right – see the table above.",[584,1161,1162,1167],{},[599,1163,1164],{},[437,1165,1166],{},"The document belongs to another issuer",[599,1168,1169,1170,1173],{},"Almost always Entra ID with ",[706,1171,1172],{},"common"," instead of your tenant ID.",[584,1175,1176,1181],{},[599,1177,1178],{},[437,1179,1180],{},"The metadata holds up. Certificate valid until …",[599,1182,1183],{},"SAML: all good – try a sign-in.",[584,1185,1186,1191],{},[599,1187,1188],{},[437,1189,1190],{},"Your provider's metadata has changed",[599,1192,1193,1194,491],{},"SAML: usually a new certificate. Click ",[437,1195,1196],{},"Reload metadata",[584,1198,1199,1204],{},[599,1200,1201],{},[437,1202,1203],{},"The signing certificate expired on …",[599,1205,1206],{},"SAML: create a new certificate at your provider, then reload or paste the metadata again.",[493,1208,1210],{"id":1209},"_4-switch-it-on","4. Switch it on",[433,1212,1213,1214,1091],{},"In the card ",[437,1215,1216],{},"Access",[535,1218,1219,1225,1235,1241],{},[501,1220,1221,1224],{},[437,1222,1223],{},"Single sign-on active"," – from now on the button appears for your domains.",[501,1226,1227,1230,1231,491],{},[437,1228,1229],{},"Domains"," – leave it empty and the provider is responsible for all your confirmed domains. Choose some if it should only sign in those – see ",[489,1232,1234],{"href":1233},"#several-providers","Several providers",[501,1236,1237,1240],{},[437,1238,1239],{},"Create accounts on first sign-in"," – somebody your provider knows, with an address on your domain, gets an account and a membership the first time they sign in. Switch it off if only people you invited or imported are to get in.",[501,1242,1243,1246,1247,1251],{},[437,1244,1245],{},"Group for new people"," – whoever joins through this provider and is placed in no group by a ",[489,1248,1250],{"href":1249},"#map-groups","mapping"," lands in this group, so they see something straight away.",[433,1253,1254],{},[512,1255],{"alt":1256,"src":1257},"The Access card","\u002Fscreens\u002Fen\u002Fdocs-cms-sso-access.webp",[433,1259,1260,1261,491],{},"Then try it: open a private browser window, go to the sign-in page, type your address and click ",[437,1262,506],{},[481,1264,1265,1268],{},[433,1266,1267],{},"People who already have a DDM account – invited by hand or imported from a directory – are recognised by their e-mail address the first time they use single sign-on. They keep their groups and their history. Their DDM password, if they have one, still works too – unless you require single sign-on.",[433,1269,1270,1271,491],{},"If nobody ever confirmed the address, though – say because somebody else registered with it first –, the account belongs to the person your provider vouches for from their first sign-in through it: every existing session ends, and the account's password and other ways in are removed. A new password is set with ",[437,1272,1273],{},"Forgotten your password?",[493,1275,1277],{"id":1276},"map-groups","Map groups",[433,1279,1280,1281,1284],{},"Your provider knows who is in sales and who is in marketing. With a group mapping, DDM takes that over: at ",[437,1282,1283],{},"every"," sign-in, people are put into the DDM groups that match their groups at your provider.",[498,1286,1287,1299,1305],{},[501,1288,1213,1289,1292,1293,1296,1297,491],{},[437,1290,1291],{},"Groups",", enter the ",[437,1294,1295],{},"Group claim"," – the claim (OpenID Connect) or attribute (SAML) in which your provider lists somebody's groups. Mostly ",[706,1298,889],{},[501,1300,642,1301,1304],{},[437,1302,1303],{},"Add mapping"," for each group: on the left the value as your provider sends it, on the right the DDM group.",[501,1306,642,1307,491],{},[437,1308,895],{},[433,1310,1311],{},[512,1312],{"alt":1313,"src":1314},"The Groups card","\u002Fscreens\u002Fen\u002Fdocs-cms-sso-groups.webp",[433,1316,1317],{},"What the value looks like depends on the provider:",[578,1319,1320,1332],{},[581,1321,1322],{},[584,1323,1324,1326,1329],{},[587,1325,603],{},[587,1327,1328],{},"The claim contains",[587,1330,1331],{},"Set up at the provider",[594,1333,1334,1361,1381],{},[584,1335,1336,1338,1348],{},[599,1337,213],{},[599,1339,1340,1341,1344,1345],{},"the groups' ",[437,1342,1343],{},"Object IDs",", e.g. ",[706,1346,1347],{},"5f3c2a…",[599,1349,1350,476,1353,1356,1357],{},[437,1351,1352],{},"Token configuration",[437,1354,1355],{},"Add groups claim"," – see ",[489,1358,1360],{"href":1359},"\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id#_6-map-groups","Entra ID",[584,1362,1363,1365,1371],{},[599,1364,218],{},[599,1366,1367,1368],{},"the ",[437,1369,1370],{},"group names",[599,1372,1373,1374,1377,1378],{},"a ",[437,1375,1376],{},"Groups claim filter"," on the app – see ",[489,1379,218],{"href":1380},"\u002Fen\u002Fsign-in-and-directories\u002Fokta#map-groups",[584,1382,1383,1385,1391],{},[599,1384,223],{},[599,1386,1387,1388,1390],{},"only with SAML: the ",[437,1389,1370],{}," or addresses",[599,1392,1393,1396,1397],{},[437,1394,1395],{},"Group membership"," in the SAML app – see ",[489,1398,223],{"href":1399},"\u002Fen\u002Fsign-in-and-directories\u002Fgoogle-workspace#map-groups",[433,1401,1402],{},"The rules:",[535,1404,1405,1411,1417,1424,1427],{},[501,1406,1407,1410],{},[437,1408,1409],{},"A mapped group is your provider's to fill."," Whoever has a mapped value is put into the group; whoever no longer has it leaves the group at their next sign-in. Values are compared without regard to upper and lower case.",[501,1412,1413,1416],{},[437,1414,1415],{},"Groups without a mapping are left alone"," – whoever put somebody into them, by hand or by a directory.",[501,1418,1419,1420,1423],{},"If somebody is in ",[437,1421,1422],{},"none"," of the mapped groups, their group claim may be missing altogether – that counts as „no groups\", and they leave the mapped groups.",[501,1425,1426],{},"Exception: Entra ID sends no group list for somebody in more than 200 groups, only a reference. DDM then leaves their groups as they are.",[501,1428,1429,1431],{},[437,1430,1245],{}," applies only when no mapping placed a newcomer.",[968,1433,1434,1435,1438,1439,1441],{},"Changes at your provider take effect at the person's ",[437,1436,1437],{},"next sign-in",". If somebody has to lose access straight away, also remove them in DDM under ",[437,1440,68],{},", or block them.",[493,1443,1234],{"id":1444},"several-providers",[433,1446,1447,1448,1450],{},"An organisation can connect several identity providers – click ",[437,1449,571],{}," again. Typical cases:",[535,1452,1453,1479],{},[501,1454,1455,1458,1459,1462,1463,1466,1467,1462,1470,1473,1474,476,1476,1478],{},[437,1456,1457],{},"A subsidiary with its own tenant",": Provider ",[636,1460,1461],{},"Kunde Entra"," for ",[706,1464,1465],{},"company.com",", provider ",[636,1468,1469],{},"Tochter Okta",[706,1471,1472],{},"subsidiary.com"," – under ",[437,1475,1216],{},[437,1477,1229],{},", limit each to its domain.",[501,1480,1481,1484],{},[437,1482,1483],{},"A move",": the new provider next to the old one, both active, until everybody has signed in once with the new one. Then switch the old one off.",[433,1486,1487],{},"On the sign-in page, somebody sees one button for each active provider that is responsible for their domain. A provider limited to some domains has no say over addresses on the others – even if it reported one, DDM would refuse the sign-in.",[433,1489,1490],{},"People are linked to each provider separately. Somebody who already signed in through the old provider is recognised by their e-mail address the first time they use the new one.",[493,1492,1494],{"id":1493},"require-single-sign-on","Require single sign-on",[433,1496,1497,1499,1500,439,1503,1506,1507,1509],{},[437,1498,1494],{}," switches off the password for the provider's domains: people can no longer sign in with a DDM password or a company password, only through your provider. That includes the installation's ",[437,1501,1502],{},"Microsoft",[437,1504,1505],{},"Google"," and ",[437,1508,218],{}," buttons, and nobody can register with a password under these domains any more. The sign-in page then shows only the button.",[433,1511,1512,1515,1516,1519],{},[437,1513,1514],{},"Owners"," of the organisation can still sign in with their password – via ",[437,1517,1518],{},"Sign in with a password instead",". That is the way back in if your provider fails or its configuration breaks; nobody can fix the configuration through a provider that does not work. Make sure at least one owner has a DDM password.",[493,1521,1523],{"id":1522},"who-gets-in","Who gets in",[433,1525,1526],{},"DDM decides itself who your provider may sign in:",[578,1528,1529,1539],{},[581,1530,1531],{},[584,1532,1533,1536],{},[587,1534,1535],{},"Situation",[587,1537,1538],{},"What happens",[594,1540,1541,1549,1560,1570,1582,1590],{},[584,1542,1543,1546],{},[599,1544,1545],{},"Address on your confirmed domain, already a member",[599,1547,1548],{},"signed in",[584,1550,1551,1554],{},[599,1552,1553],{},"Address on your domain, has a DDM account but is not a member yet",[599,1555,1556,1557,1559],{},"becomes a member – if ",[437,1558,1239],{}," is on",[584,1561,1562,1565],{},[599,1563,1564],{},"Address on your domain, not in DDM yet",[599,1566,1567,1568,1559],{},"gets an account and a membership – if ",[437,1569,1239],{},[584,1571,1572,1579],{},[599,1573,1574,1575,1578],{},"Address ",[437,1576,1577],{},"not"," on one of your confirmed domains – or not on one of the provider's domains",[599,1580,1581],{},"refused, whatever your provider says",[584,1583,1584,1587],{},[599,1585,1586],{},"Blocked in your organisation",[599,1588,1589],{},"refused",[584,1591,1592,1595],{},[599,1593,1594],{},"Platform operators",[599,1596,1597],{},"refused – they always sign in with their own password",[433,1599,1600,1601,1604],{},"Every single sign-on that reaches DDM – successful or refused – is recorded in the ",[437,1602,1603],{},"Audit log",", refusals with the reason, successful ones with the groups that were added or removed.",[493,1606,1608],{"id":1607},"messages-your-people-may-see","Messages your people may see",[578,1610,1611,1620],{},[581,1612,1613],{},[584,1614,1615,1617],{},[587,1616,1100],{},[587,1618,1619],{},"Cause",[594,1621,1622,1634,1644,1656,1668,1678],{},[584,1623,1624,1629],{},[599,1625,1626],{},[437,1627,1628],{},"You were signed in, but there is no account for you here yet",[599,1630,1631,1633],{},[437,1632,1239],{}," is off – invite the person or switch it on.",[584,1635,1636,1641],{},[599,1637,1638],{},[437,1639,1640],{},"You were signed in, but your e-mail address is not on one of your organisation's confirmed domains",[599,1642,1643],{},"The provider reported an address on another domain – check the person's e-mail address in your provider, or confirm the domain.",[584,1645,1646,1651],{},[599,1647,1648],{},[437,1649,1650],{},"Your account is blocked in this organisation",[599,1652,1653,1654,491],{},"Unblock under ",[437,1655,68],{},[584,1657,1658,1663],{},[599,1659,1660],{},[437,1661,1662],{},"Single sign-on is not switched on for your organisation",[599,1664,1665,1667],{},[437,1666,1223],{}," is off.",[584,1669,1670,1675],{},[599,1671,1672],{},[437,1673,1674],{},"Your organisation signs in through its own sign-in system",[599,1676,1677],{},"Single sign-on is required, and the person tried a password.",[584,1679,1680,1685],{},[599,1681,1682],{},[437,1683,1684],{},"Single sign-on did not work",[599,1686,1687,1688,1690,1691,491],{},"Your provider refused, or its answer did not fit the configuration – check with ",[437,1689,1086],{},", and look at the error your provider showed; for Entra ID see ",[489,1692,1694],{"href":1693},"\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id#common-errors","Common errors",[493,1696,1698],{"id":1697},"changing-or-removing-a-provider","Changing or removing a provider",[433,1700,1701,1702,1704,1705,1707,1708,1710],{},"Change a field and click ",[437,1703,895],{}," – a new client secret, for example, when the old one expires. If you change the ",[437,1706,837],{},", DDM reads the new provider's configuration again. For SAML, ",[437,1709,1196],{}," takes over a new certificate from the metadata URL.",[433,1712,1713,1714,1717,1718,1721,1722,1724],{},"The bin beside the provider's name (",[437,1715,1716],{},"Remove provider",") asks first – confirm with ",[437,1719,1720],{},"Remove permanently",". It deletes its configuration and the links between your people and that provider. Whoever is signed in through it is signed out – as when you switch it off. The people stay, with their groups. Whoever has no DDM password and no other provider sets a password with ",[437,1723,1273],{}," on the sign-in page.",[493,1726,1728],{"id":1727},"for-whoever-runs-ddm","For whoever runs DDM",[535,1730,1731,1737,1751,1769],{},[501,1732,1733,1736],{},[437,1734,1735],{},"Nothing to configure"," for providers on the internet – Entra ID, Okta, Google and other cloud providers work straight away, with both protocols.",[501,1738,1739,1742,1743,1746,1747,1750],{},[437,1740,1741],{},"A provider on the customer's own network"," (Keycloak, ADFS on the LAN) has to be allowed: put its address in ",[706,1744,1745],{},"SSO_TRUSTED_ORIGINS",", several separated by commas, e.g. ",[706,1748,1749],{},"SSO_TRUSTED_ORIGINS=\"https:\u002F\u002Fsso.company.local\"",". That applies to SAML metadata URLs too.",[501,1752,1753,1756,1757,1760,1761,1764,1765,1768],{},[437,1754,1755],{},"The app on its own address"," (e.g. ",[706,1758,1759],{},"app.company.com"," next to ",[706,1762,1763],{},"ddm.company.com","): both must be on the same parent domain, with ",[706,1766,1767],{},"AUTH_COOKIE_DOMAIN=\"company.com\""," – otherwise the app does not notice the sign-in.",[501,1770,1771,1774,1775,1778],{},[437,1772,1773],{},"SAML providers post the sign-in back"," to ",[706,1776,1777],{},"\u003CBETTER_AUTH_URL>\u002Fapi\u002Fauth\u002Fsso\u002Fsaml2\u002Fsp\u002Facs\u002F…"," from their own address; a reverse proxy or web application firewall in front of DDM must let that through.",{"title":704,"searchDepth":1780,"depth":1780,"links":1781},2,[1782,1783,1784,1785,1790,1795,1796,1797,1798,1799,1800,1801,1802],{"id":495,"depth":1780,"text":496},{"id":532,"depth":1780,"text":533},{"id":559,"depth":1780,"text":560},{"id":655,"depth":1780,"text":656,"children":1786},[1787,1789],{"id":663,"depth":1788,"text":465},3,{"id":727,"depth":1788,"text":469},{"id":813,"depth":1780,"text":814,"children":1791},[1792,1793,1794],{"id":817,"depth":1788,"text":465},{"id":980,"depth":1788,"text":469},{"id":1085,"depth":1788,"text":1086},{"id":1209,"depth":1780,"text":1210},{"id":1276,"depth":1780,"text":1277},{"id":1444,"depth":1780,"text":1234},{"id":1493,"depth":1780,"text":1494},{"id":1522,"depth":1780,"text":1523},{"id":1607,"depth":1780,"text":1608},{"id":1697,"depth":1780,"text":1698},{"id":1727,"depth":1780,"text":1728},"Connect your organisation's own identity provider – Entra ID, Okta, Google Workspace or any OpenID Connect or SAML provider – so your people sign in with the account they already have.","md",null,{},{"icon":190},{"title":199,"description":1803},"VBUHD8rMDAjKLfY0wKT5mmtDv_T1BgOaqox1srV7kv8",[1811,1813],{"title":195,"path":196,"stem":197,"description":1812,"icon":19,"children":-1},"Which ways into DDM there are, who sets them up, and how a person ends up in your organisation.",{"title":203,"path":204,"stem":205,"description":1814,"icon":206,"children":-1},"Connect Active Directory, OpenLDAP or another LDAP directory – import people, sort them into groups, let them sign in with their company password.",1793617719123]