Enabling Single Sign-On for the TechInsights Platform

Support for industry-standard Single Sign-On (SSO) within the TechInsights Platform gives end users immediate access to their TechInsights subscriptions while enhancing security for your organization, at no additional cost.
Configuration is straightforward, and does not require a dedicated session with our Customer Engagement staff, though such a session is available to any customer upon request. Technical staff are on-call to ensure any issues are resolved quickly.

Help Me Engage my IT Department on SSO

SSO

Since SSO relies on your organization’s identity systems, your IT department needs to carry out the process outlined below.

For IT Departments: Process to Enable SSO

TechInsights supports a wide range of Identity Providers (IDPs), with streamlined support for SSO via Azure AD, Okta, Google Workspace, and PingFederate Identity Providers (IDPs), as well as full support of any SAML- or OIDC-based IDP that your organization may have deployed. Technical staff are on-call to ensure any issues are resolved quickly.

To enable SSO, there are two options:

Email Your SSO Config

Setup via Email. Find your IDP in the sections below, and send in the relevant information for that IDP type to support@techinsights.com. A meeting with Customer Engagement is not typically required unless problems are encountered. Other communication options aside from email can be arranged as needed.

Set up a Meeting with Customer Engagement

Setup Directly with Customer Engagement. Arrange a meeting with our Customer Engagement team to have them walk you through the process. For increased efficiency, prepare by finding your IDP in the sections below and gathering the relevant information for that IDP type ahead of time.

Configuring Azure AD

Steps:

Create a new application called “TechInsights” and register it with Azure AD (details)
Set the Redirect URI to https://auth0.techinsights.com/login/callback: (details:)
Create a client secret, and record it so you can provide it to TechInsights (details:)
Add permissions for the Microsoft Graph API (details:)
- Users > User.Read
Send the following information to support@techinsights.com:
- Azure AD Domain (on Overview page)
- Application (client) ID (on Overview page)
- Client secret (recorded above)

Upon receiving the email, TechInsights Customer Engagement will be in touch to complete the configuration and enable SSO. A session with Customer Engagement is not typically required unless problems are encountered.

Alternate methods of communicating the client secret can also be arranged as desired. At your option, TechInsights supports submission of a certificate for authentication in place of the client secret.

Configuring Okta

Steps:

Create a new OIDC application called “TechInsights” in Okta (details)
In General Settings, set the Sign-in Redirect URI to https://auth0.techinsights.com/login/callback (a href="https://help.okta.com/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_OIDC.htm" tabindex="-1">details)
Under Client Credentials, create a client secret, and record it so you can provide it to TechInsights (details)
Send the following information to support@techinsights.com:
- Okta Domain (at top of the Okta dashboard)
- Client ID (on General tab, Client Credentials section)
- Client secret (recorded above)

Configuring Google Workspace

Steps:

Create a new OAuth 2.0 application as a Web Application called “TechInsights” in Google (details)
- Name: TechInsights
- Authorized JavaScript Origins: auth0.techinsights.com
- Authorized Redirect URIs: https://auth0.techinsights.com/login/callback
On the OAuth Consent page, under Authorized Domains (details):
- Add auth0.com
On the Client Details page, click Add Secret to create a client secret, and record it so you can provide it to TechInsights (details)
Send the following information to support@techinsights.com:
- Google Workspace Domain
- Client ID (in APIs & Services, under Credentials)
- Client secret (recorded above)

Configuring PingFederate

Steps:

Create a new Application (Connection) in PingFederate, using the name of your organization in lowercase letters (details)
- Entity ID: urn:auth0:techinsights-auth:{yourOrgName} (replace {yourOrgName} with the name of your organization in lowercase letters)
- Post-back URL: https://auth0.techinsights.com/login/callback?connection={yourOrgName} (replace {yourOrgName} with the name of your organization in lowercase letters)
Generate Signing Certificate for the Application
Send the following information to support@techinsights.com:
- Sign In URL
- X.509 Signing Certificate (as PEM or CER)
- The exact text used to replace {yourOrgName} above

Configuring Other Identity Providers

For configuration of SAML, OIDC, or other Identity Providers, please contact support@techinsights.com.

How to Engage Your IT Department on SSO

To find the right person in your organization, you can ask who is responsible for Single Sign-On configuration for cloud or SaaS applications. These professionals typically reside in groups with names such as User Identity, Authentication, Cloud Applications, SaaS Applications, Cloud Security, or similar.

To reach out, you can use the email template below, which will help to provide your colleagues with technical context and a clear understanding of the low level of effort required to enable SSO for the TechInsights Platform.

Subject: SSO config for key cloud application

One of our cloud applications from TechInsights is mandating SSO. For our users to keep access, our IDP would need to be configured to work with their application. We need to make the changes in advance of October 16, 2023, or we’ll lose access to our paid subscriptions.

TechInsights supports popular directories such as Azure AD, Okta, Google, and Ping, as well as protocols such as SAML and OIDC.

TechInsights has indicated that the configuration process is very simple, and typically takes only a few minutes to complete. A full description of the process is provided here: Enabling Single Sign-On for the TechInsights Platform.

We want to avoid leaving this too late. When do you think this could be done?