Home›Authentication & SSO›Authentication and SSO overview

Authentication and SSO overview

Understand how users sign in to Interact, whether through single sign-on or a local directory account.

This section covers how people sign in to Interact — through single sign-on with your identity provider, or with a local directory account held in Interact.

How sign-in works

Interact authenticates users in one of two ways, depending on how their account is set up. Once a user is authenticated, their access inside Interact is governed by their profile and group membership, which you keep current through user provisioning. Authentication and provisioning are separate concerns: one proves who a user is, the other decides what they can see.

SAML single sign-on

Single sign-on (SSO) lets users access Interact with their existing corporate credentials, with no separate password to manage. Interact supports the SAML 2.0 standard and works with any compliant identity provider. Guided setup is available for the common ones:

Start with Configure SAML single sign-on for the general setup, then follow the page for your provider. If you need to supply your service provider metadata, see SAML metadata.

Local directory

For users who do not sign in through an external identity provider, Interact can hold a local account with its own password. Passwords are stored securely, and you can configure password complexity requirements to match your organisation's security policy. See Local directory authentication.

Two-factor authentication

Whichever sign-in method a user has, you can require a second factor at sign-in with a TOTP authenticator app. It can be enforced for everyone or just a selected group. See Two-factor authentication.

Note: Authenticating a user does not create their profile. Pair your chosen sign-in method with a provisioning approach so users have complete, up-to-date profiles when they arrive.

Where to start

Section: Authentication & SSO