ClearCosupports Single Sign-On (SSO) via SAML, allowing your employees to log in with the same credentials they use for other business applications. This gives your organization full control over password policies and employee access management.
In this article:
Supported Identity Providers
Username Configuration
Setup Process
Identity Provider Setup Instructions
Troubleshooting
Additional Resources
Supported Identity Providers
ClearCo supports both cloud-based and on-premise identity providers:
- Cloud Providers: ClearCo is an approved vendor in the Okta and OneLogin app stores, and will work with any cloud identity provider that supports SAML, including AzureAD, Google, and PingIdentity.
- On-Premise Providers: ClearCo supports self-hosted, SAML-compatible identity providers, including ADFS. ADFS users can configure SAML support directly on their ADFS server or use a low-cost native plugin available from OneLogin.
Note
Only one SSO provider can be active at a time. For example, ADP and AzureAD cannot be configured simultaneously.
Prerequisites
Before beginning the SSO setup, the following information must be provided to ClearCo.
- Identity Provider SSO Login URL: ClearCompany will automatically redirect to this URL when a user in an SSO-enabled org logs in via https://[shortname].clearcompany.com.
- x.509 Certificate: A public certificate used to match and verify IdP requests.
- Federation Metadata File (optional but recommended): If available, this file can be parsed to extract the Login URL and x.509 Certificate automatically.
Username Configuration
The NameID value configured in the client's Identity Provider must match the Employee Username field within ClearCompany.
- If ClearCo is the Service Provider: The NameID value in the IdP must match the Employee Username field in ClearCo. This field can be found under Tools > Setup > Users. ClearCompany typically recommends using the employee's email address as the NameID value.
- If ClearCo is the Identity Provider: This field can be adjusted as needed.
Setup Process
- SSO is purchased.
- You will configure and test the Identity Provider.
- You will provide ClearCo with the Identity Provider SSO Login URL and x.509 Certificate.
- ClearCo implements the configuration on its end.
- A testing window is scheduled where SSO is enabled for the organization. ClearCo will be available during this time to quickly disable SSO if any errors occur.
- Any issues are troubleshot collaboratively.
- SSO is fully enabled.
Identity Provider Setup Instructions
Please follow the instructions for your Identity Provider:
- ADFS Instructions: SSO Setup
- AzureAD Instructions: SSO Setup - AzureAD
- Google Instructions: SSO Setup
- Okta Instructions: SSO Setup
- OneLogin Instructions: SSO Setup
Troubleshooting
If a user receives an error when attempting to log in via SSO.
A ClearCo User Admin should verify the user's username and primary email address by navigating to Tools > Setup > Users, searching for the user, and selecting Edit User. Ensure there are no extra spaces before or after the username or email address.
Contact your IT Admin to confirm the ClearCompany username and primary email address matches the email address assigned to the user in your organization's IdP or network settings. The IT Admin should also confirm the user has been granted access to the correct applications.
If a user is experiencing login issues, check for duplicate accounts:
Navigate to Tools > Setup > Users.
Under "Filter Employees," check both Deleted and Terminated user statuses to look for duplicates associated with the affected individual.
If duplicates exist, open the duplicate record and select Edit User. Ensure the username and primary email address do not match those of the active user account, then save.
Users accessing the system through email links (such as Offer Letter approvals) should still be able to authenticate via SSO and be directed to the correct page after login. If users report needing to click a link twice, once to authenticate and once to reach the destination page, check whether your IdP supports RelayState passthrough.
Additional Resources
Absorb LMS WoW App: Configuring SSO
ADP Bi-Directional: Assign the ClearCompany App to Users for SSO Login
Manage a User's Sign-In Method for SSO Mixed Mode
Configure your Organization's Login Method
Comments
Please sign in to leave a comment.