Overview

In this article, we'll cover GrowthLoop's support for Single Sign-On (SSO) and the various identity providers and protocols that you can use for your SSO configuration. GrowthLoop supports SSO to provide a seamless and secure authentication experience. You can configure SSO with GrowthLoop using your identity provider and connect via SAML (Security Assertion Markup Language), OIDC (OpenID Connect) protocols, or LDAP protocols.

While we support multiple protocols, most of our SSO integrations are done via SAML, and this guide will assume a SAML configuration for your setup.

Supported identity providers and services

GrowthLoop (via Auth0) currently supports the following identity providers and services with streamlined integrations:

• ADFS
• Azure Active Directory Native
• Okta
• Active Directory/LDAP
• Google Workspace
• PingFederate
• Azure Active Directory
• Custom connections to any SAML or OIDC-compatible identity provider

Set up SSO

Follow these steps to configure Single Sign-On (SSO) with an Identity Provider in GrowthLoop, assuming a SAML setup. Need help? Your Solutions Architect will be available to support you throughout the process!

Step 1: Client App URL Setup (for Multi-Tenant Environments)

If your organization uses a multi-tenant environment, GrowthLoop will set up a custom URL for your dedicated SSO login. This requires coordination with our engineering team to update the domain and deploy the new environment. The domain format will be {client}.flywheelproducts.com.

📘

Note

This step is unnecessary if your organization uses a single-tenant environment.

Step 2: Setup Info for Your SSO

To set up an SSO connection in your identity provider (e.g., Okta, Azure AD), you'll need the following information from your Solutions Architect:

• Client ID: urn:auth0:vortex-prod:{<client-name>-connection}
• Reply URL (Assertion Consumer Service URL): https://vortex-prod.auth0.com/login/callback?connection={<client-name>-connection}
• Sign-On URL (Sign-in Redirect URIs): https://vortex-prod.auth0.com/login/callback?connection=<client-name>-connection
• Logout URL: https://<client-name>.flywheelproducts.com/auth/logout
• Trusted Origins: https://app.flywheelproducts.com

In response, provide your Solutions Architect with the following information from your side:

• Sign-In URL
• X509 Signing Certificate
• Data mappings for user_id and email

Step 3: Configure Connection in Auth0

Once your domain is set up, your Solutions Architect will configure the SAML connection in Auth0. The connection name in Auth0 must match {client}-connection to dynamically update your login page with your organization's SSO configuration.

Configuration details

• Sign-In URL: Provided by your identity provider during the setup process.
• X509 Signing Certificate: Obtained during your setup process with your identity provider.
• Data Mappings: Ensure correct mappings for user_id and email. These values will determine how users are identified and routed within our system.

Step 4: Testing and Verification

We recommend conducting a thorough testing phase to ensure that the connection is working as expected. This can often be done by GrowthLoop without involving you directly, especially if your Solutions Architect has access to your system. However, if needed, we can coordinate a call to assist with debugging.

Test your connection

1. Enable Debug Mode: Set the connection to debug mode in the Auth0 connection settings.
2. Monitor Logs: Use Auth0's "Monitoring" > "Logs" section to track login attempts.
3. Test Login: Have someone from your organization attempt a login. Review the logs to ensure proper authentication and data mappings.
4. Final Configuration: Adjust any mappings as needed based on test results. Ensure that user IDs and email attributes are correctly configured.

If everything is functioning as expected, the connection will be live, and you will be able to log in using SSO.

Map groups to teams and roles

Existing SSO connections continue to work when team-specific roles are enabled. You can map multiple groups from your identity provider's SSO payload to GrowthLoop teams and roles. When multiple matching groups grant roles on the same team, those roles combine for that team.

1. Open the profile dropdown in the header and select Organization, then select SSO after your connection is enabled.
2. Under Team and Role Mapping, add a mapping for each group. Enter the exact IdP Group Name, then select the GrowthLoop Team and GrowthLoop Role.
3. Configure Default Group Mappings if users who do not match a group mapping should receive a default team and role. Leave both default fields blank if you do not want a default assignment.
4. Click Save.
5. Ask a teammate to sign in through SSO, then verify their teams and roles in Organization > Users.

For example, these synthetic mappings give a teammate Admin and User roles in Marketing when both groups appear in their SSO payload:

The Analytics mapping grants User on Analytics only. Those permissions do not add to the Marketing team's permissions. See Role management and permissions for how team roles combine and who can manage them.

📘

Note

Multiple roles per team depend on team-specific roles being enabled for your organization. SSO can add mapped roles to existing team memberships at sign-in. Removing a group mapping does not automatically remove roles already assigned to a user; review their roles in Users when changing access.

Congratulations! Your teammates can use SSO with the team access you configured.

📘

Note

If you experience any issues or have questions during the setup process, please reach out to us at [email protected], and we’ll be in touch shortly!