Access & SSO page overview

The Access & SSO page is where you choose who can read your knowledge base and how readers log in, including single sign-on (SSO). It brings together settings that used to live on three different pages: Single sign-on, Security settings, and Website settings. If you're looking for a setting you used to find on one of those pages, jump to Where did my settings go?

Go to the Access & SSO page

To open the page:

1. Go to Security and access > Access & SSO. The overview opens.

The overview has four cards: Who can read this knowledge base?, Images and files, Login settings, and Login methods. Each login method also has its own view, which you open from the Login methods card.

If your SAML IdP certificate has expired, a Your SAML certificate has expired message appears at the top of the overview. Select Update certificate to go straight to the certificate in the SAML view.

Who can read this knowledge base?

Use this card to choose whether your knowledge base is public or private, and how private readers get in.

The Who can read this knowledge base? card

A few things to know about this card:

• When you select Allowed IP addresses or a shared password, its fields appear: Allowed IP addresses, Shared password, and the checkbox Require both an allowed IP address and the shared password. Refer to Restrict by IP address, shared passwords, reader logins, or a combination for details.
• You can only select Your own login system (remote authentication) once you've saved a remote login URL. Until then, it shows an Add your remote login URL first button.
• If SAML, OpenID Connect, or Salesforce SSO is set to Required, the options are replaced by a message that readers who aren't logged in are sent to that method, with a button to open it, like Manage SAML.
• Reader group logic appears at the bottom of the card only if your knowledge base uses exclusive reader group logic. Choose Inclusive (readers in any of the groups can read it) or Exclusive (readers must be in every one of the groups).

Images and files

This card shows whether only logged-in readers can open your images and files, or anyone with a link can. Select Require login... or Use public links... to switch. This option is only available for private knowledge bases, so choose and save one of the private options under Who can read this knowledge base? first.

Changes on this card apply right away, not through the save bar. KnowledgeOwl updates every image and file link, which can take a while, and images may look broken until it finishes. Refer to Require login to view files/images for more information.

Login settings

• Session length: How long readers stay logged in. Any reader activity resets the clock. The default is two hours.
• Basic authentication: Select Let designated readers log in with basic authentication to let third-party tools crawl a private knowledge base. Refer to Basic authentication for details.

Login methods

This card lists every way readers can log in. You can offer as many as you need, for example direct login for most readers and SAML for staff.

The Login methods card

Send readers who aren't logged in to

Choose where readers go when they open restricted content or select the Log in link: Reader login page, Remote login URL, SAML login, or OpenID Connect login. A choice that isn't set up yet shows (not set up) and can't be selected.

This dropdown only appears on plans with SSO, and only when a login method is set to Required or Who can read this knowledge base? isn't Logged-in readers only. With Logged-in readers only, readers who aren't logged in go to the reader login page. If a login method is set to Required, the dropdown is locked to that method.

Login method rows

Each row shows the method's name, its status, a short description, any warnings, and, when the method is in use, its Login link with a copy icon. Select Set up or Manage to open the method's view.

SAML, OpenID Connect, remote authentication, and Salesforce SSO are single sign-on methods. This feature is available on select plans. If your plan doesn't include SSO, those rows show an Upgrade button instead of a status.

Status words

Each row shows one of these statuses:

When several methods are required

Only one method can be where readers who aren't logged in are sent. If you set more than one to Required, the one with the highest priority wins, in this order:

1. SAML
2. OpenID Connect
3. Salesforce SSO
4. Remote authentication

Only the first keeps the Required status. The others show Available and still work through their own login links. When you set a method to Required while another is already required, you're asked to confirm with Save anyway.

When SAML or OpenID Connect is Required, direct login shows Off unless Logged-in readers only is selected. You can still let readers use their usernames and passwords from the Direct login view.

Login method views

Select Set up or Manage on a login method to open its view. Each view has a breadcrumb back to Access & SSO, the method's status next to its title, and numbered steps. Each collapsed step shows a summary, and the step's circle shows a check mark when it's complete. You can open the steps in any order. Some views also have a collapsed Advanced options card.

• Direct login: Choose Off or Available for the reader login page and the Log in link in your knowledge base header, and set Password management for this knowledge base.
• SAML: Five steps, from Give these details to your identity provider to Turn on SAML. Refer to Configure SAML SSO (generic instructions).
• OpenID Connect (OIDC): Choose your identity provider, then follow the steps for it. Refer to Configure OpenID Connect SSO.
• Remote authentication: Enter your Remote login URL and Remote logout URL, and copy Your knowledge base ID.
• Salesforce SSO: Copy the KnowledgeOwl auth token, enter your Salesforce login URL, and choose whether to require Salesforce SSO.

Save your changes

When you change a setting, a bar appears at the bottom of the page with You have unsaved changes. Select Save changes to save, or Discard to undo them.

• The overview and each login method view have their own save bar. Unsaved changes stay put while you move between views.
• If you leave the overview with unsaved changes, you're asked to Save and continue or Discard changes.
• Some changes apply right away, without the save bar: Images and files, uploading a SAML IdP certificate, custom rules, and ClassLink district changes.
• If you change a private knowledge base to Public, you're asked to confirm.

Where did my settings go?

Use this table to find settings from the old Single sign-on page, the old Security settings page, and Website settings. All new locations are in Security and access > Access & SSO unless noted.