Single Sign-On (SSO)

Overview
Features & Limitations
Set up Single Sign-On (SSO)
- Entra ID
- Okta
- OneLogin
FAQs

Overview

Single Sign-On (SSO) authentication allows users to access multiple applications through an Identity Provider (IdP) using a single set of login credentials. Using SSO allows you to improve the security of your account and makes it easier for your users to login.

We have documented the SSO setup process for the most common IdPs: Okta, Entra ID, and OneLogin. Our SSO solution supports any IdP that offers the OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) 2.0 protocols.

It's your responsibility to secure your IdP and implement necessary security measures. We're not responsible for losses if your IdP is compromised or unauthorised parties access your GoCardless account through your IdP while SSO is enabled.

Features and limitations

Features

We support these SSO features:

Configure and test your SSO configuration from the GoCardless dashboard.
Enforce SSO for all your users: to get the full security benefits you can enforce SSO to make it the only way your users can sign in (sign in using password and GoCardless 2-factor authentication will be disabled).
Service Provider-initiated SSO: Initiate SSO login directly from the GoCardless login page.
Multi-account support: for users of our multi-account feature, configure SSO once at the parent account level and it will apply to all accounts in the account group.

Limitations

We do not support these SSO features:

Automated just-in-time account creation upon first SSO sign in: new users will need to be invited manually from the GoCardless dashboard.
System for Cross-domain Identity Management (SCIM): a protocol that automates the exchange of user identity information and lifecycle processes between the IdP and service provider (e.g. GoCardless).
IdP-initiated SSO: Authenticate directly from an IdP’s website or browser extension. This means you will not be able to log into the GoCardless dashboard from a bookmark/tile in your IdP dashboard or similar, only from the GoCardless login screen.

If your organisation has multiple GoCardless accounts

Important: If your organisation has multiple GoCardless accounts but you don’t have the multi-account feature enabled, you must set that up first in order to start using SSO.

The multi-account feature enables you to manage your account structures by linking multiple GoCardless accounts in a parent-child structure.
If you have the multi-account feature enabled, you configure and enforce SSO once on the parent account and the configuration and enforcement will automatically apply to all accounts in the account group.
In addition to ensuring all users on the parent account are provisioned through the IdP, please also ensure all users on child accounts have also been provisioned before enforcing SSO.

Set up SSO

Entra ID

These are the steps to set up SSO with Microsoft Entra ID. You must have Admin access to your GoCardless account in order to configure, enable and enforce SSO.

Using OIDC

Start SSO setup

Log in to the GoCardless dashboard as an Admin user
In the top right click Settings > Account settings
In the section Single Sign-On (SSO) click Set up SSO.
A new tab will open where you can configure SSO in an Auth0-hosted journey. Click to proceed.
Select your IdP and click Next.

Create application

Follow the instructions in the configuration journey.

Configure connection

Follow the instructions in the configuration journey.

Claims mapping

Navigate back to your application, and then on the left-hand tab, select Manage > Token configuration, and click Add optional claim.
Select Token type ID and claim “email”, “family_name” and “given_name”.
Click Add, and you may get a dialogue to enable a feature, which we recommend you do.

Assign access

Under Manage > App roles > click How do I assign App roles.
Click the hyperlink on Assign app roles with 'User' allowed member types in Enterprise applications or in Microsoft Graph APIs.
Select Assign users and groups > Add user/group, and add the user(s) or group.

Test your configuration

Skip ahead to the Test your configuration steps below.

Using SAML

Start SSO setup

Log in to the GoCardless dashboard as an Admin user
In the top right click Settings > Account settings
In the section Single Sign-On (SSO) click Set up SSO.
A new tab will open where you can configure SSO in an Auth0-hosted journey. Click to proceed.
Select Custom SAML and click Next.

Create Application

This is where to get the “Single Sign-On URL” and “Service Provider Entity ID” values you need to set in Entra ID.

Set up SAML application in Entra ID

Configure connection

This is where to set the Metadata URL that you get in the previous step.

Attribute mapping

Create necessary claims (in Entra ID, check the box for Expose claim in JWT tokens in addition to SAML tokens)

Test your configuration

Use the Test Connection button in the configuration journey to review the attributes that are being passed.
If everything looks good, click Enable Connection and proceed.
- SSO is now enabled and, if the configuration is all working correctly, you and your users can use it to log in. Next you will try logging in with SSO to check it is working as expected.
Sign out of the GoCardless dashboard.
Sign back in using the Sign in with SSO button on the login page.
- If successful, move to the next step.
- If unsuccessful, you can login as usual with your password while you troubleshoot your configuration.

Complete setup

If you are satisfied that SSO is working as expected, you can enforce SSO for your users. Enforcing SSO will make it the required method of authentication for all users on your GoCardless account. This means they will no longer be able to login using their password or two-factor authentication.

You can enforce SSO from your SSO settings in the dashboard. If you enforce SSO, your users will be sent an email to inform them they must login with SSO going forward and can no longer use password or two-factor authentication.
As some users are likely to miss this email, to prevent confusion or disruption please inform your users about this change to make sure they are aware.