Single Sign-On (SSO)

Single Sign-On (SSO) enables your users to sign in to Deque products using your organization's identity provider.

Benefits

• Centralized user management through your identity provider
• Elimination of password management overhead for Deque products
• Compliance with your organization's authentication policies
• Multi-factor authentication (MFA) support via your identity provider
• Simplified user offboarding when employees leave your organization

Feature Summary

Login Flows

SP-Initiated (Service Provider–Initiated)

User starts at a Deque product sign-in page and selects "Sign in with your organization". The user is redirected to your identity provider to authenticate, then returned to Deque.

Advantage: Works for all identity providers. No provider-specific configuration required beyond standard SAML settings.

IdP-Initiated (Identity Provider–Initiated)

User starts at your application portal, selects a Deque product tile, and is immediately sent to that product after authentication.

Advantage: Seamless user experience within your organization's application ecosystem. Requires: One separate connection for each Deque product, and provider-specific configuration (see Okta, Microsoft Entra ID, PingFederate).

Email Domains

Connections are matched on the email domain following the @ symbol. Each domain requires its own connection, and subdomains are configured separately from their parent domain.

Example: A company with users at @acme.com and @dev.acme.com requires two separate SSO connections.

All connections can point at the same identity provider.

User Provisioning

Manual Provisioning

An administrator creates user accounts in Deque before the user's first SSO sign-in. Works with all setup types.

Just-in-Time (JIT) Provisioning

The first time a user signs in via SSO, Deque automatically creates their account using information from the SAML assertion. The user's first and last name are imported if your identity provider sends them.

SCIM 2.0 Provisioning

Your identity provider automatically creates, updates, and deprovisions Deque user accounts, and can assign users to products based on directory group membership. This requires a separate setup step. See Automated User Provisioning (SCIM) for details.

Limitations and Considerations

All Users on an Enabled Domain Must Use SSO

Once SSO is live for a domain, every user with an email address at that domain signs in through your identity provider. Password sign-in is no longer available to them.

Existing Users Complete a One-Time Account Link

Users who already have a Deque login must confirm the link between their Deque account and your identity provider on their first SSO sign-in. They receive a confirmation email and select a link to complete the process.

Protocol and Format Constraints

• SAML 2.0 only
• Name ID format: Email, using Subject NameID
• Email address is the identifier; it must be unique and stable
• Group membership claims are not used for product access; use SCIM if group-based access control is required

Certificates and Trust

SSO trust is established through direct metadata exchange between your organization and Deque, rather than through a public certificate authority chain. Each party explicitly trusts the certificate provided by the other.

Key Points

• Self-signed certificates are supported. A CA-issued certificate is not required.
• Entity IDs must match exactly. An Entity ID is an identifier, not a URL. It must be character-for-character identical on both sides, including trailing slashes. A single difference causes assertions to be rejected.
• Certificates expire periodically. Signing certificates typically expire every one to three years.

Next Steps

To set up SSO, see Setting Up SSO.