Ping (SSO and User Provisioning)

Single Sign On (SSO) is available for DocBoss. If enabled, users with the company domain will be redirected to their identity provider to sign in to access DocBoss. The instructions below outline how to set up SSO and SCIM with DocBoss when using Ping as the identity provider.

SSO:

1. Open Manage Environment -> Application page
2. Click to add a new application on the "+" icon near the page title.
3. Set the name for the application and choose "OIDC Web App" type. Click to save.
4. Copy Client ID, Client Secret on the Configuration tab, general block. Make note of these to send to DocBoss Support.
5. Copy OIDC Discovery Endpoint on the Configuration tab, URLs block. Make note of this to send to DocBoss Support.
6. Click to edit Configuration settings (edit icon on the top of the configuration tab).
7. Set Redirect URIs [we give value to the instance] and set Token Auth Method = "Client Secret Post".
8. Choose "Resources" tab and click to edit allowed scopes.
9. Select "email" and "profile" scopes and save.

SCIM:

1. Open Manage Environment -> Directory -> User Attributes page.
2. Click to add a new attributes on the "+" icon near the page title.
3. Add two attributes: userType and affiliate, type = declared.
4. Open Manage Environment ->Integrations -> Provisioning page (see below)
5. Click to add a new connection on the "+" icon near the page title.
6. Choose a connection type "Identity Store".
7. Choose "SCIM Outbound" and click next.
8. Set the name for the application and click next.
9. Set following values and click next : 
   •     SCIM BASE URL = https://systemX.docboss.com/scim/v2 [X should be replaced with system number empty or 2, 3, 4, 5, 6]
   •     SCIM Version = 2.0
   •     Authentication Method = OAuth 2 Bearer Token
   •     Oauth Access Token = Docboss long term token [copy from docboss]
10. Set  User Filter Expression = userName eq "%s"  and click to save [case sensitive]
11. Click on the "+" icon near the page title to add a new rule
12. Set the name and click to create the rule.
13. Select created connection and save
14. Click to edit filter and set how the users should be selected for provisioning and save
15. 
16. Add mapping for fields. Remove excess fields added for mapping by default. 
17. List of  all avaliable parameters:
    •     "userName" - required, value should be unique. Value will be saved as login for user
    •     "familyName" - required
    •     "givenName" - required
    •     "active" - required. Value is used to disable\enable user
    •     "userType" - not required. If user doesn't add field to mapping OR send empty value "View" role will be saved. Allowed values are Admin, Full, Reviewer, View [case sensetive]
    •     "affiliate" - not required. Created with instance affiliate will be set for user
    •     "title" - not required. User can skip adding this field to mapping
18. Enable connection
19. Enable rule

Implementing

Once the steps above are complete and you have provided the information to DocBoss as noted in them, reach out to DocBoss Support and we will schedule a meeting to enable SSO (and user provisioning, if using). Our Support will also provide a redirect URI for your application. This will redirect users back to DocBoss after authentication in your identity provider. This must be added in your identity provider application for SSO to function.

If you want to try the function, then schedule a roll out for your users we can schedule the meeting to enable, test (have a user login), then disable within a few minutes. Already logged in users would not be affected. You can then communicate to your user base with a timeline for the switch. Alternatively, we can just leave it enabled after the test is successful.