A published map or dashboard normally opens for people you have invited. With single sign-on in place, you can also open it to everyone who signs in with your organization: colleagues who are not members of your Tamaat organization and were never invited. They prove who they are at your identity provider, and the map opens.
You can narrow that to chosen groups at your provider.
Before you begin
The choice appears only for an Admin of the organization, and only once your sign-in is ready for it. If something is missing, the choice is shown with the reason and a link to Single sign-on in Settings:
| What the screen says | What to do |
|---|---|
| "Switch your organization’s sign-in on." | Enable a connection. |
| "Allow people to sign in with your organization." | Set Sign-in policy to Optional or Required. |
| "Test the sign-in again." | Run "Test connection"; the result must show "Sign-in time received". |
| "Verify your organization’s email domain." | Add and verify a domain under Domains. |
| "Set up groups and test the sign-in again." | Only when you name groups: fill in the group fields on the connection and test until it shows "Groups: received". |
All of these are covered in Set Up Single Sign-On.
Turn it on
- 1
Publish the map or dashboard as usual, or open one that is already published in Server. Find "Who can open it".
- 2
Choose a restricted audience: your organization's members, or chosen groups of them. The company choice sits beside those. It is not offered with "Anyone with the link", which already opens to everyone.
- 3
Tick "Everyone who signs in with our company sign-in".
- 4
If your organization has more than one connection ready, pick one under "Sign-in".
- 5
Save. The members you chose can still open it as before; your sign-in now opens it for everyone else in the company.
Narrow it to groups
Under "Only these groups (optional)", enter one group per line, exactly as your provider sends it. The hint beneath says which form your provider uses: "Group IDs from your provider, one per line." or "Group names from your provider, one per line." "Seen in the last test" lists a few groups from your last connection test, so you can copy one.
- Leave the box empty for "All groups": everyone who signs in.
- A person is let in when their sign-in shows at least one of the groups you listed.
- Groups are matched exactly, letter for letter, capitals included.
- If your provider does not send a person's complete group list, that person is not let in.
When your provider sends names rather than IDs, Tamaat warns: "Group names can be changed at your provider. Anyone who can create a group with this name there can open this." Use IDs where your provider offers them.
What a colleague sees
Someone who opens the address without being signed in sees your organization's name and "Sign in with your organization to open this." They choose "Sign in with your organization", sign in at your provider, and the map or dashboard opens. "Sign in with a Tamaat account" stays beneath it for invited people.
The first time:
- A colleague with no Tamaat account gets one made for them, provided their email address is on a domain you have verified. It has no password. If your provider does not confirm email addresses, they type a code that Tamaat emails them, once.
- A colleague who already has a Tamaat account links it once. See Sign In With Your Organization.
A sign-in counts for one hour from the moment the person signed in at your provider. After that the page asks them to sign in with your organization again.
What such a reader can and cannot do
| A reader who came in this way… | |
|---|---|
| Opens that published map or dashboard, as you published it | Yes |
| Opens other published maps and dashboards you have opened the same way | Yes |
| Becomes a member of your organization | No |
| Takes a seat, or gets a role | No |
| Opens your workspace, your projects, layers, files or flows | No |
| Opens published maps and dashboards that are not opened this way | No |
| Edits anything, or publishes anything | No |
You can see these people. In Settings, under Organization → Single sign-on, the People list has a "Reads applications only" filter that shows everyone who has come in through a published map or dashboard and holds no place in your organization.
When it stops opening
A published map or dashboard opened this way depends on your sign-in. It stops opening for company readers when you:
- disable the connection,
- set Sign-in policy to Off, or
- enable a changed version of the connection. Readers come back in at their next sign-in.
Tamaat tells you before any of these, with the number affected: "published applications that open with this sign-in will stop opening until people sign in again." While the sign-in is off, the audience shows "Not in use. Check Single sign-on in Settings." Your choice is kept and works again when the sign-in does.
To close it for good, untick "Everyone who signs in with our company sign-in" and save. To shut out one person, see Remove Someone's Access.