Use Single Sign-On for Account Manager

Customers with identity management systems like Okta, OneLogin, Ping Identity, and Microsoft ADFS require their employees to authenticate to 8x8 apps using their company ID instead of an 8x8 username and password. In this release, we support SAML 2.0 & Google OAuth Federated Single Sign-On (SSO) for the following 8x8 applications that use the shared 8x8 login page:

• Account Manager
• Virtual Contact Center
• Virtual Office desktop app
• Virtual Office online app
• Virtual Office mobile app
• Virtual Office Analytics
• Switchboard Pro

With support for Federated SSO, users can log in to 8x8 applications through their company's identity management system.

Identity Mapping

Ideally, the system maps each company user to an 8x8 user via the 8x8 username. If your company's 8x8 usernames are not unique email addresses, you have to populate either of these new 8x8 user attributes via Account Manager:

• For SAML SSO: Federated ID
• For Google SSO: Google ID

Configure Federated Single Sign-On

Configuring access to 8x8 applications via federated SSO requires you to:

1. Set up SAML in the company's identity management system: Not covered in this document, since the process varies with the identity management system adopted by your company, and is typically managed by its administrator.
   • For Okta: Search for 8x8 Inc in the Okta Application catalog and add it. Follow the SAML 2.0 setup instructions provided for 8x8 users with matching Okta usernames. For 8x8 users without matching Okta usernames, the Federated ID is populated as normal in Account Manager.
   • For OneLogin: Search for 8x8 in the OneLogin Application catalog. Under Configuration > Connectors, select Connector Version: SAML 2.0.
2. Set up Single Sign-On in Account Manager: Set up by the Virtual Office administrator. The administrator must set up Single Sign-On and specify the identity provider used by the company.
   To set up Single Sign-On:

   1. Click Accounts in the top navigation bar.
   2. Under the Accounts menu, click Single Sign-On.
      
   3. Select an identity provider from the following choices:
      • 8x8 Username and Password: Allows users to log in to 8x8 applications using an 8x8 username and password. If this check box is cleared, only the primary administrator can log in using their 8x8 username and password. All other users must use Google or SAML SSO.
      • SAML: Allows users to log in to 8x8 applications by signing in via SAML.
      • Google: Allows users to use a Google ID to to log in to 8x8 applications.
   4. Select the User Mapping Field that maps each user from your SAML identity provider or Google directory to 8x8. The system begins by matching via 8x8 username. If that fails, 8x8 looks up and matches via Federated ID (for SAML) or Google ID (for Google OAuth).
      • 8x8 Username: The system maps via 8x8 username.
      • Federated ID: For SAML, 8x8 maps via Federated ID.
      • Google ID: For Google OAuth, 8x8 maps via Google ID.
   5. Save these settings.
   6. If you selected SAML,you should specify the following:
      • Sign In URL: User authentication URL provided by identity provider (IDP).
      • Sign Out URL: User sign out URL provided by IDP to end the IDP session. The 8x8 app calls this URL after you log out of the 8x8 app. If your IDP can redirect to another URL after it ends the IDP session, you should append the variable string <{8x8Logout}>, which inserts the 8x8 login URL so the user can log back in later.
        For Okta, the sign out URL may be https://YOUR_COMPANY.okta.com/login/signout?fromURI={8x8Logout}.
      • Issuer URL: IDP identifier.
      • Identity Provider Certificate: Your identity management system should provide an X.509 certificate file to download. Browse to locate the certificate file and upload here.
        
        The certificate file is validated and notifies you of any errors.
   7. Click Save. This completes the configuration of SAML or Google-federated SSO.
3. Define Federated ID or Google ID in User Profiles: This step is optional. If your company does not use unique email addresses for 8x8 usernames, then you must map Virtual Office users to their Federated ID (for SAML) or Google ID (for Google) in the list of user profiles.
   To define Federated ID or Google ID:

   1. Click Accounts.
   2. Under the Accounts menu, click User Profiles.
   3. To edit an individual profile:
      1. Click Edit next to the desired user.
         Based on the choice of identity provider, the corresponding mapping field shows:
         • For SAML, the Federated ID field is available.
         • For Google, the Google ID field is available.
      2. From the list, edit the desired user profile to add the mapping field data:
         • For SAML, populate the Federated ID.
         • For Google, populate the Google ID.
         
   4. To edit profiles in batches:
      1. Click Download CSV Template.
      2. Open the downloaded CSV file in Microsoft Excel, or any spreadsheet app.
      3. Add the desired username to the relevant ID field for each user, and save the file.
      4. From Account Manager, click Upload CSV Template to upload the edited file.
   5. Save your changes.

   For 8x8 Users with Matching Okta Usernames

   If all your users have 8x8 usernames (such as [email protected]) that match (not case-sensitive) their Okta usernames:

   • No additional 8x8 user configuration is required for Single Sign-On.
   • 8x8 uses the 8x8 Username field to map each 8x8 user account to the Okta user account.

   Note: If you have any users with 8x8 usernames that do not match their Okta usernames, you must define the Federated ID in the user profile for all users manually in Account Manager.

Sign in Using Federated SSO

The sign-in process for 8x8 applications is similar whether it is authenticated via SAML or Google. The initial sign-in process takes users through the Virtual Office login page. Go to the 8x8 SSO login page, or launch the Virtual Office desktop app.

1. In the login screen, click Use Single Sign On.
   
   The SSO login prompt opens.
2. Enter your 8x8 username or company email for validation.
   
3. Click Continue to view your SSO options.
4. Click Log in using SAML to open your identity provider's login page.
   OR
   Click Log in using Google to open the Google login page.

   Note: Clicking Clear SSO Setting takes you back to the first login page.

   • To log in with SAML:

     1. If you selected Log in using SAML, your company's identity provider login page opens.
        

        Note: If you log in using Okta or Centrify, the login page opens in a new browser tab instead of in the application window. Until you log in, the application window reads Login from browser....

        
     2. Enter the credentials to log in to the identity provider.
        The application launches.

        Note: For consecutive SSO login sessions, you are routed from the custom login page (Step 4).

   • To log in with Google:

     1. If you selected Log in using Google, the Google login page opens.
     2. Enter your company Gmail address and password.
        
     3. Click Allow to grant 8x8 Single Sign-On access to your Gmail profile.
        
        You are now authenticated to your 8x8 app. The application launches.
5. When prompted, click Allow to enable Adobe Flash Player settings to access your camera and/or microphone.

See Also