View desktop instructions

View mobile app instructions
Enable SAML Single Sign-On

Published on: Tue, 18 Apr, 2023 at 3:06 AM | Updated on: Thu, 28 Nov, 2024 at 7:02 AM

Account administrators can enable single sign-on (SSO) for account users to access your brand's impact.com account through a supported identity provider (IDP), or via a unique sign-in link. Choose a method you prefer.

SAML single sign-on uses a connection (or connector) for impact.com with your identity provider. impact.com currently supports the following providers:

AD FS
Okta
OneLogin
Microsoft Entra ID

Enable SAML Single Sign-On

This feature is only accessible to specific impact.com editions or add-ons. Contact us to upgrade your account and get access!

Step 1: Upload IDP metadata file

Before beginning, make sure you have your IDP metadata file in .XML format handy — this file needs to be uploaded to impact.com.

From the left navigation menu, select [Menu] → Settings.
In the left column, under General, select Account User Authentication.
Next to the Authentication type line item, select [Check box] SAML and use the [Drop-down menu] to select your identity provider.
Use the file picker to find and upload your .XML metadata file.
At the bottom of the screen, select Save.

Step 2: Enable SAML single sign-on for account users

The following instructions need to be completed for each individual user that will use SAML SSO:

From the left navigation menu, select [Menu] → Settings.
In the left column, go to General and select Account Users.
Hover your cursor over a user and select [More] → Edit Access Rights
In the User Signup Method section, select SAML.
At the bottom of the slide-out, select Save.

Step 3: User sign in via SSO

There are two ways to access impact.com via an SSO connection — via the identity provider's connection/connector, or with a unique login link to your brand's impact.com account.

Configure a connection with your identity provider, then use that connection to sign in to impact.com.

Important: For IDP (OneLogin, AD FS, Okta, and Microsoft Entra ID) configurations, the user’s email address in impact.com must exactly match the email address for the user in your IDP configuration — mismatched email addresses will not work.

OneLogin

In the OneLogin platform, find the Impact Partnership Cloud connection with the OneLogin App Catalog. Follow the onscreen instructions with the app to enable and configure this connection.

ADFS, Okta, & Microsoft Entra ID

Create a new custom connection with the following settings:

Single Sign On URL	https://app.impact.com/saml/SSO
Recipient URL	https://app.impact.com/saml/SSO
Destination URL	https://app.impact.com/saml/SSO
Audience Restriction	https://app.impact.com
Name ID Format	EmailAddress
Response	Signed
Assertion Signature	Signed
Signature Algorithm	RSA_SHA1
Digest Signature	SHA1
Assertion Encryption	Unencrypted
SAML Single Logout	Disabled
AuthnContextClassRef	PasswordProtectedTransport

Note: The value you provide for your custom connection must match exactly with the appropriate value above. E.g., your custom value for Audience Restriction cannot be https://app.impact.com/, as this has an extra / symbol.

If the user is not using the specific connection via their identity provider, they can use your brand's login link for SSO into the platform. Follow these steps to get the login link:

From the left navigation menu, select [Menu] → Settings.
In the left column, under Branding, select Advertiser Login Branding.
From the Login Link field, copy & save the Login Link to distribute to your impact.com account members.

Note: All members not using SSO via your IDP must sign in to your brand's impact.com account via this link — the standard sign-in page does not support SAML.

Enable SAML Single Sign-On

Related Articles