Setting Up SSO

Setting up SSO is an exchange of SAML metadata between your organization and Deque. Neither party requires access to the other's systems.

Prerequisites

Before you begin, ensure you have:

• Administrator access to your identity provider
• The list of Deque products in scope
• Every email domain your users sign in with, including subdomains
• A test user who already exists in your identity provider
• Technical contacts who can configure SAML and test the connection

The Setup Process

Setup runs in three phases. For IdP-initiated login, the process repeats once for each Deque product.

Requesting SSO

Contact helpdesk@deque.com or your Deque representative with the following:

• Your organization name
• Every email domain in scope
• The Deque products in scope
• Your identity provider
• Whether you want SP-initiated or IdP-initiated login
• Your technical contacts

Deque then sends you a Service Provider Entity ID and SP metadata (XML) for each product. For IdP-initiated setups, you receive one Entity ID for each product.

Choosing Your Login Flow

Deque supports two SSO login flows. Choose based on your organization's identity provider capabilities:

Both flows are secure and SAML 2.0-compliant. Proceed to the section matching your choice below.

SP-Initiated Flow Configuration

For SP-initiated login, Deque manages the Service Provider configuration. Your role is to import Deque's metadata into your identity provider.

SAML Settings for SP-Initiated Login

Only one SAML setting is unique to your organization:

Metadata Import

Import the SP metadata (XML file or URL) that Deque provided:

• If your identity provider has a "metadata import" or "metadata URL" option, use Deque's metadata URL directly.
• Otherwise, download the XML file and upload it to your identity provider.
• Your IdP will auto-populate most settings; no additional SAML configuration is required.

After importing Deque's metadata, proceed to Testing below.

IdP-Initiated Flow Configuration

For IdP-initiated login, you manually configure a SAML application in your identity provider using Deque's metadata.

Selecting the Entity ID Value

The Entity ID is the entityID attribute of the md:EntityDescriptor element in the metadata file Deque provided. Its value ends with /clients/<client name>. For example:

https://auth.deque.com/.../axe.<your-domain>/endpoint/clients/axe-login-idp

This single value is used in two places: the Entity ID and the Reply URL (or ACS URL). Enter the same value for both fields.

SAML Settings for IdP-Initiated Login

These settings apply to every identity provider for IdP-initiated login:

Attribute Mapping

Send the following attributes so that first and last name are imported on first sign-in:

The attribute name format differs by provider. Okta and Microsoft Entra ID use Unspecified; PingFederate uses urn:oasis:names:tc:SAML:2.0:attrname-format:uri. If the format is set incorrectly, names are not imported and users are asked to enter them on first sign-in.

Assigning Users

Assign the users and groups who should have access. Most identity providers block sign-in for users who are not assigned. Assignment controls who can authenticate; it does not grant access to Deque products.

Provider-Specific Configuration

Follow the guide for your identity provider:

• Okta
• Microsoft Entra ID
• PingFederate

Any other SAML 2.0-compliant provider is supported. Use the SAML settings above and consult your provider's documentation for the location of each field.

Sending Deque Your Metadata

After configuring your identity provider, send Deque your metadata. Send either a metadata URL or an exported XML file; both contain the values Deque requires:

For IdP-Initiated Login Only: IdP-Initiated Start URL

In addition to your metadata, send Deque your IdP-initiated start URL. This value is not included in your metadata and must be sent separately:

Deque then imports your SSO URL and certificate, enables signature validation, and confirms when the connection is ready to test. The connection remains disabled until you go live, so it cannot affect your users' existing sign-in.

Testing

Confirm the following:

1. The user reaches your sign-in page and authenticates, including multi-factor authentication.
2. The user returns to Deque and arrives in the product.
3. The user's name and email address are correct on their Deque profile.
4. A user without an existing Deque account is created correctly.
5. A user with an existing Deque account completes the account link successfully.

Account Linking

Users who already have a Deque login must confirm the link between their Deque account and your identity provider on their first SSO sign-in. Deque sends a confirmation email, and the user selects the link to complete the process. This occurs once for each user.

Going Live

Once testing succeeds and your users have been notified, tell Deque when to enable the connection permanently. From that point, every user on the enabled domain signs in through your identity provider.

Base URLs

Use the base URL for your region or dedicated instance.