---
title: "Single Sign On Configuration"
slug: "single-sign-on-configuration-1-1"
updated: 2026-10-29T17:05:25Z
published: 2026-10-29T17:05:25Z
canonical: "wiki.cobblestonesoftware.com/single-sign-on-configuration-1-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.cobblestonesoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign On Configuration

**COBBLESTONE SOFTWARE**

Contract Insight — User Guide

**Single Sign On Configuration**

*Single Sign-On › Single Sign On Configuration*

**Note:** Each procedure in this guide begins at the Contract Insight homepage, so any section can be followed on its own. Custom fields are configurable, so the exact field list on a contract category record may vary between environments.

# 1. Overview

**Administration → Single Sign-On** is where SAML 2.0 and ADFS / WS-Federation federated sign-in is configured. The page has two independent tabs: **Your people** (internal employees) and **Vendors & clients (Gateway)** (Vendor/Client Gateway sign-in). Each tab has its own login method, identity provider certificates, and SSO configurations, so changing one never affects how the other signs in. The usual order is: give your identity provider (IdP) the Contract Insight service provider metadata, upload the IdP's signing certificate, set up an SSO configuration, and then switch the login method.

# 2. Key Elements

- **Your people** and **Vendors & clients (Gateway)** tabs: separate login methods, certificates, and configurations for internal users and Gateway users.
- **Login Method**: **Standard (username / password)**, **Integrated Windows Authentication**, **SAML 2.0 Single Sign-On**, or **ADFS / WS-Federation**, with **Refresh configuration** and **Apply**. On the Gateway tab, Standard reads **Standard (user name, password and company id)**.
- **Service Provider Metadata**: **SAML metadata (XML)**, **WS-Fed metadata (XML)**, and **SP signing certificate (.cer)** to give to your IdP.
- **Identity Provider Certificates**: the IdP's signing certificates, added with **Add certificate**.
- **SSO Configurations**: each named configuration, with **Edit**, **Just-in-time provisioning**, metadata download, and delete actions.
- **Debug log**: recent sign-in attempts traced while a configuration's **Debugging** setting is on.

# 3. Navigating to Single Sign-On

1. From the Contract Insight homepage, click the **Administration** icon at the bottom of the left navigation bar.
2. In **Search administration**, type **single sign** (or scroll to the **Security & Access** category).
3. Click **Single Sign-On**.

![Administration search showing Single Sign-On](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/01_admin_search(2).png)

The page opens on the **Your people** tab. Click **Vendors & clients (Gateway)** to configure Gateway sign-in instead (see Section 8).

![Single Sign-On Your people tab](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/02_sso_your_people.png)

# 4. Exchanging Metadata and Certificates with Your Identity Provider

## 4a. Giving Contract Insight's Metadata to the IdP

1. Under **Service Provider Metadata (give these to your IdP)**, click **SAML metadata (XML)** for SAML 2.0, or **WS-Fed metadata (XML)** for ADFS / WS-Federation.
2. If your IdP needs it separately, click **SP signing certificate (.cer)**.
3. Give these files to your identity provider administrator.

## 4b. Adding the IdP's Signing Certificate

1. Scroll to **Identity Provider Certificates** and click **Add certificate**.

![Identity Provider Certificates and SSO Configurations](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/03_certs_configs.png)

1. In the **Add Certificate** window, either:
  - **Option 1:** click **Choose File** and upload a **.cer** file or an XML metadata file that contains an X509 certificate, or
  - **Option 2:** enter the IdP's metadata **URL** and click **Download**.
2. The certificate is listed with its **Name**, **Expires** date, and **Active** status.

![Add Certificate window](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/04_add_certificate.png)

# 5. Setting Up an SSO Configuration

1. Under **SSO Configurations**, click **Add configuration**, or click **Edit** on an existing configuration. For an existing configuration, the **Edit Configuration** section opens below the list.
2. Enter a **Name** and turn **Active** on.
3. Choose the **Single Sign On Mode**: **Single Sign On Only**, or **Single Sign On and Standard Logins**.
4. Copy the **Standard Login Address** and keep it somewhere an administrator can find it. It shows the username-and-password form even when SSO is in use, and nothing in the application links to it.
5. Enter the **IDP Login URL** (where users are redirected to authenticate), the **Audience Restriction**, and the **Entity ID** (if blank, the ACS URL is used).
6. Set **User Name Location**: **NameId**, or **Attribute** with the attribute name exactly as it appears in the assertion (case sensitive).

![Edit Configuration fields (top)](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/05_edit_config_top.png)

1. Set the **SP Initiate Method** (**Post** or **Redirect**) and the **Assertion Consumer Service URL** the IdP should send authentications to.
2. Optionally turn on **Enable Single Logout** and enter the **Single Logout URL**. Single logout may sign the user out of other systems managed by the IdP.
3. Optionally turn on **Debugging** to trace sign-in attempts (see Section 9).
4. Click **Save**, or **Cancel** to discard changes.

![Edit Configuration fields (bottom)](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/06_edit_config_bottom.png)

**Note:** **Single Sign On Only** closes the Standard Login Address. Everyone, administrators included, is sent to your identity provider. Use **Single Sign On and Standard Logins** while you are testing.

# 6. Switching the Login Method

1. At the top of the tab, under **Login Method**, choose **SAML 2.0 Single Sign-On** or **ADFS / WS-Federation** (see the screenshot in Section 3).
2. Click **Apply**.

**Note:** **Refresh configuration** re-reads every setting on the page from the database into the running instance. Use it after a change was made on another server or directly in the database.

# 7. Just-In-Time (JIT) Provisioning

1. On the configuration's row under **SSO Configurations**, click the **Just-in-time provisioning** (person) icon.
2. Under **Settings**, turn on the options you need:
  - **Create users (JIT)**: create a Contract Insight account when someone your IdP recognizes signs in and no matching account exists.
  - **Update users (JIT)**: update an existing account's details from a matching definition when its owner signs back in.
  - **Overwrite security groups on update**: replace the account's security groups instead of only adding to them.
  - **Trim whitespace** and **Case-insensitive comparisons**: control how IdP values are compared against conditions.
3. Click **Save Settings**.

![Just-In-Time Provisioning settings](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/07_jit_settings.png)

1. Under **Definitions**, click **Add Definition**, or **Edit** on an existing one. A definition decides, from conditions on the incoming IdP data, whether to create or update an account and how to fill it in.

![Just-In-Time Provisioning definitions](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/08_jit_definitions.png)

**Tip:** The most common setup is two definitions: one for creating new accounts (with broader defaults), and a more limited one for updating existing accounts (names, titles, email). See **SSO - Just in Time** for full details on definitions.

# 8. Configuring Gateway (Vendor/Client) Sign-In

1. On the Single Sign-On page, click the **Vendors & clients (Gateway)** tab.
2. Repeat Sections 4 through 7 on this tab: it has its own identity provider, certificate, and configurations.
3. Choose the **Login Method** and click **Apply**. The standard option here is **Standard (user name, password and company id)**.

![Vendors and clients Gateway tab](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/09_gateway_tab.png)

# 9. Troubleshooting with the Debug Log

1. Turn on **Debugging** in the SSO configuration (Section 5) and sign in again through the IdP.
2. On the Single Sign-On page, click **Debug log**.
3. Select a traced sign-in attempt to review its individual steps. Click **Refresh** to load new attempts.

![SSO Debug Log panel](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/10_debug_log.png)

**Note:** Turn **Debugging** off again when you are finished.

# 10. Quick Reference Summary

| Task | How to Complete It |
| --- | --- |
| Open Single Sign-On | Administration → search “single sign” → **Single Sign-On**. |
| Give your IdP the SP metadata | **Service Provider Metadata** → **SAML metadata (XML)** or **WS-Fed metadata (XML)**. |
| Add the IdP signing certificate | **Identity Provider Certificates** → **Add certificate** → upload a file or download from a URL. |
| Create or edit a configuration | **SSO Configurations** → **Add configuration** or **Edit** → **Save**. |
| Turn on SSO | **Login Method** → SAML 2.0 or ADFS / WS-Federation → **Apply**. |
| Set up JIT provisioning | Configuration row → person icon → **Settings** and **Definitions**. |
| Configure Gateway sign-in | **Vendors & clients (Gateway)** tab. |
| Review sign-in traces | Turn on **Debugging** → **Debug log**. |