Tim & Perusahaan

Set up single sign-on and provisioning

Connect your identity provider with SAML or OIDC, verify your domain, require SSO, and let SCIM add and remove people for you.

With single sign-on, your people sign in to Dvina through your company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace. With provisioning (SCIM), your directory adds and removes people, and its groups become teams.

Single sign-on, provisioning and sign-in rules come with the Enterprise plan. Owners and admins set them up in Settings › Security.

Add an identity provider

  1. Open Settings and choose Security.
  2. Under Single sign-on, choose Add Identity Provider.
  3. Choose a Protocol: SAML 2.0 or OIDC.
  4. Enter the Domain your people's email addresses use, like company.com.
  5. Under Details, enter what your identity provider gives you:
    • For SAML 2.0: the Entity ID, the Sign-In URL and the Metadata XML.
    • For OIDC: the Issuer URL, the Client ID and the Client secret.
  6. Choose Add.

The provider shows as Not Verified until you verify its domain.

Verify your domain

A provider signs nobody in until its domain is verified.

  1. In Settings › Security, choose the provider.
  2. Under Verify Domain, copy the record's Name and Value.
  3. Add them as a TXT record in your domain's DNS.
  4. Choose Check Record. It can take a few minutes for the record to be found.

When it's found, the provider shows Verified.

How people join

When someone at your verified domain signs in with SSO for the first time, Dvina adds them to your Livespace. Choose the role they get in New People Join As: Member or Admin.

Each person who joins takes a seat. When every seat is taken, they can't join until you add seats.

Require SSO

Once a domain is verified, you can make single sign-on the only way in.

  1. In Settings › Security, turn on Require SSO.
  2. Choose Require SSO to confirm.

Members with a verified domain must sign in with SSO from then on. Owners can still sign in another way.

Catatan

To remove your last verified identity provider, turn off Require SSO first.

Set up provisioning (SCIM)

  1. In Settings › Security, under Provisioning (SCIM), choose Create SCIM Token.
  2. Copy the token and paste it into your identity provider, with the SCIM Base URL. You won't see the token again.

From then on, your identity provider keeps the Livespace in step with your directory:

  • A person it adds becomes a member, with the role in New People Join As.
  • Each group it sends becomes a team.
  • When it deactivates or removes someone, they leave the Livespace and their access ends at once. The reports they built go to someone on the team.
  • Fields such as department, cost_center, division, organization, employee_number, title and user_type come from your identity provider as member attributes.

To replace the token, choose it, then choose Rotate Token. The current token stops working at once, so paste the new one into your identity provider. To stop provisioning, choose Revoke Token.

Other sign-in rules

The Sign-In group on the same page sets two-step verification, how long sessions last and the networks people may sign in from.

Require two-step verification

  1. In Settings › Security, under Sign-In, turn on Require Two-Step Verification.
  2. Choose Require to confirm.

Members without it set up an authenticator app the next time they sign in.

Set how long sessions last

Under Sign-In, choose:

  • Sign-In Lasts: how long a sign-in stays valid before people sign in again. It's 30 days unless you choose 7 days, 1 day, 12 hours, 8 hours or 1 hour.
  • Sign Out When Idle: how long a device may sit unused before it's signed out. It's Never unless you choose 7 days, 1 day, 8 hours, 1 hour or 15 minutes.

Limit sign-in to your networks

Allowed Networks shows Everywhere until you add a network.

  1. Under Sign-In, choose Allowed Networks.
  2. In IP addresses and ranges, enter one address or range per line, like 203.0.113.0/24.
  3. Choose Save, then Limit Access to confirm.

People outside these networks lose access at once, including you if your network isn't listed. To allow every network again, leave the list empty and save.

Good to know

  • Every change to single sign-on and provisioning is recorded in the audit log.
  • Passkeys work too.