Single sign-on lets people open your organization's work in Tamaat with the account your company already gives them, the one they use for email and everything else. Your identity provider checks who they are. Tamaat decides what they can open.
An Admin sets it up in Settings, under Organization → Single sign-on. Only Admins of the organization see that section.
Who it is for
- Admins who want people to use one company account for Tamaat, under the sign-in rules the company already has.
- Members who would rather not keep another password.
- Admins who publish and want a map or dashboard to open for everyone in the company without inviting each person. See Open a Map or Dashboard to Your Company.
The three settings
Under Sign-in policy an organization is in one of three states:
| Setting | What the screen says | What it means |
|---|---|---|
| Off | "Password sign-in only" | Nobody signs in through your organization. |
| Optional | "Password or single sign-on" | Each person uses either. Start here. |
| Required | "Single sign-on only" | A password no longer opens your organization's work. See Require Single Sign-On. |
What it does not do
Single sign-on answers one question: who is this person. It does not decide who belongs to your organization.
- Joining stays by invitation. A company email address, or an account at your identity provider, does not make anyone a member. An Admin invites each person under Organization → Members & sharing, as before.
- Nothing is copied from your provider. Tamaat does not create members from your provider's directory, and it does not remove them when they leave it. You invite people and remove people in Tamaat.
- Groups at your provider do not set roles. Roles, seats and sharing are set in Tamaat. Provider groups are used for one thing only: narrowing who can open a published map or dashboard.
- A verified domain does not add members. In the words of the settings screen: "A verified domain sends people to this sign-in. It does not add members."
- It opens one organization. A sign-in through your organization opens your organization's work. Anything else the person belongs to still asks for their own Tamaat password.
Tamaat creates an account at a first sign-in in two cases only: for a person who holds an invitation, and for a person opening a published map or dashboard that you have opened to everyone who signs in with your organization.
What this release connects to
This release connects through OpenID Connect. Providers that connect only through SAML cannot be connected in this release. Providers You Can Connect lists each provider and where it stands.
Guides
Add a connection, test it, enable it.
8 min
Which providers are offered, and how far each is tested.
2 min
The one provider we have tested ourselves.
6 min
What a provider must offer, and the limits.
4 min
For members: signing in, linking an account, signing in again.
5 min
The readiness list, the recovery person, and how to stop.
5 min
Everyone who signs in with your organization, or chosen groups.
4 min
Remove a link, remove a member, and what the provider alone does not do.
4 min
Each message, what it means, and the next step.
6 min