SSO With SAML: Implementation & Self-Service setup Guide #
Overview #
Single Sign-On (SSO) allows Enterprise users to access Quality Clouds with their corporate credentials. When enabled, users authenticate through their company’s Identity Provider (IdP) using the SAML 2.0 standard, while Quality Clouds acts as the Service Provider (SP).
No passwords are transferred between Quality Clouds and the IdP. Instead, a digitally signed SAML assertion is exchanged, ensuring secure and trusted authentication.
Benefits of using single sign-on #
Implementing SSO with Quality Clouds provides organizations with:
Stronger security compliance
- IT admins enforce corporate authentication policies.
- Users cannot override names, emails, or password rules.
Simplified access for employees
- Employees log in with their existing company credentials.
- No need for additional Quality Clouds passwords.
Improved productivity
- Reduced password fatigue.
- Seamless adoption across teams.
Scalable user management
- Just-in-time provisioning creates accounts automatically at first login.
- Users removed from your directory lose access immediately, while their work history remains.
Centralized control
- Consistent identity management across all enterprise systems.
- Flexible username mapping to match your corporate directory and SSO identity providery.
Insight into adoption
- SSO metrics and login activity tracking help measure platform usage.
Limitations of Single Sign-On #
When SSO/SAML integration is active, users:
- Cannot edit their name or email address directly in Quality Clouds.
- Cannot link multiple accounts to the same email.
- Cannot use Quality Clouds-managed two-step verification (must use IdP MFA).
- Cannot log in with Google or Microsoft credentials.
- May need one-time passwords for certain tools (e.g., Backup Tool, legacy API-v2 apps).
Enabling SSO: Two Options #
Option A: Self-Service SSO Setup (Recommended) #
- Available directly in the Admin Portal.
- Guided setup to configure and manage SSO without contacting support.
- Flexibility to update or adjust SSO settings as your organization evolves.
- Empowers admins to control secure access independently.
Key Advantages:
- Faster setup (no support dependency).
- Lower operational overhead.
- Greater confidence and control over authentication policies.
Option B: Support-Assisted Setup #
- Contact Quality Clouds support to enable SSO.
- You will need to provide:
- IdP Entity ID
- IdP Consumer URL
- Public x509 certificate in PEM format
Preconditions #
Before enabling SSO, ensure that:
-
Every user’s Quality Clouds email matches the email in your company directory.
-
Each user has only one account associated with their company email.
-
A unique workspace name (URI-compliant) is chosen for your SAML setup.
Implementation Steps #
Setup with Azure AD #
-
Add an Enterprise Application in Azure AD → choose Azure SAML Toolkit.
-
Rename the application as preferred.
-
Configure SSO fields (ACS, Entity ID, certificate).
-
Download the SAML Signing Certificate in PEM format.
-
Assign users/groups who should have access.
- Note: qc_username is the SSO mapping field in Quality Clouds. By default, it is populated with the user’s email address. However, this field can be customized to match an internal identifier if it differs from the user’s email addresses.
Setup with Okta #
- Add the App
- Set SAML Assertion Consumer Service URL (Single Sign on url) with: https://services.qualityclouds.com/saml2/qualityclouds/acs
- Use same value for destination
- Set SP Entity ID: https://services.qualityclouds.com/saml2/qualityclouds
- Go to Sign on tab and click View Setup Instructions
- Send Quality Clouds the values as described in the next section
- Assign users who can access the application
7. User Guide #
Once SSO is enabled (either via self-service or support-assisted setup), users log in via:
id.qualityclouds.com/sso/<your_workspace>
They will be redirected to their corporate IdP login page and authenticated with their company credentials.
