SAML SSO and multiple ProdPad accounts

← Back to SAML section

• Availability
  • Plan: Performance and Enterprise
• Roles and Permissions
  • Admins only

Performance and Enterprise customers with 2 or more accounts can associate their separate accounts with a single SAML SSO authentication type.

For users with access to some or all of these accounts, login access can also be dictated in the SAML assertion to determine the user's primary account that they will be created in at first login and when they login each time afterwards.

Users can also be invited to other accounts associated with the SAML SSO authentication type by account admins.

Linking accounts to a SAML Authentication Type

You can link accounts when creating a new SAML authentication type or by editing an existing authentication type and select the accounts from the options in the "Associate Accounts" field.

Once saved, you will see the linked accounts indicated under Associated Accounts the SAML authentication type information.

For linked accounts, under Account Settings > Security > SSO/SAML they will see an indication that this account had been linked to a SAML authentication type and the account name and account ID that the authentication type was set up on.

Determining a users account via a SAML assertion

When managing your SAML users in multiple accounts it is important to configure the users primary account ID - this will dictate the account they are created in when first logging into ProdPad and the account they are directed to when making subsequent logins.

To determine the account the user is created in you must:

• configure a SAML claim/parameter attribute named User.AccountId pass across the account ID in the SAML assertion.
• this attribute should be populated with the value of a numerical account ID.

The account ID for an account can be see under the Account Settings heading next to the account's company name.

The account ID of any associated accounts can be seen when hovering over the account name under Associated Accounts in the authentication type.

Inviting users to associated accounts

Once a user has been added to their primary account via SAML authentication, they can now be invited to associated accounts by account admins using the Invite Users function found under Account Settings > Users & Permissions.

When invited the user is automatically created in that account and receives an email to notify them that they have been added. The user can now login to ProdPad and navigate to the associated account using the account switching menu, found by clicking the avatar in the top left corner

Adding users to associated accounts via a SCIM integration

Customers on Performance plans and above who have set up a SCIM integration can automatically provision their users to multiple accounts by updating the SCIM schema or attribute (claim) mapping in their IdP.

To configure your IdP to send account IDs with the SCIM payload, you will need to add a custom claim/attribute named  accounts in your IdP user attributes.

If your IdP supports SCIM via attribute mapping you will need to update your current mapping to send this value as part of the SCIM provisioning sync.

If your IdP supports SCIM configuration via JSON templates, update the current SCIM JSON template to the match template below:

{<br>"schemas": [<br>"urn:ietf:params:scim:schemas:core:2.0:User",<br>"urn:scim:prodpad:2.0:schema"<br>],<br>"userName": "{$user.email}",<br>"name": {<br>"familyName": "{$user.lastname}",<br>"givenName": "{$user.firstname}"<br>},<br>"urn:scim:prodpad:2.0:schema": {<br>"accounts": "{$parameters.accounts}"<br>}<br>}

The accounts value can be populated by a single account ID or by multiple comma delimited IDs (i.e.  1,2,3).

Warning - If SCIM is enabled but an  accounts attribute is not supplied the user provisioning will default to creating users in the primary account associated with the authentication connector.