Single sign-on (SSO) lets people log in to PartnerPage through your company's identity provider, such as Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace or OneLogin. PartnerPage supports SAML 2.0 and OpenID Connect (OIDC) through its login provider, Auth0. The PartnerPage engineering team sets up every SSO connection with your IT team: the dashboard has no self-serve SSO screen.
Who can do this: your IT team, with PartnerPage support · Availability: Enterprise plan; contact PartnerPage support to ask about other plans. Not sure which plan you have? See Settings > Plans or contact support@partnerpage.io.
Which identity providers work with PartnerPage SSO
PartnerPage SSO works with any identity provider that supports SAML 2.0 or OIDC, including Okta, Microsoft Entra ID (Azure AD), Google Workspace and OneLogin. Your IT team picks one protocol for the connection: SAML 2.0 or OIDC.
SSO for your team vs SSO for your partners
PartnerPage SSO can serve two groups of people, and each one is a separate connection.
SSO for your own team. Your employees log in to the PartnerPage dashboard with their work account. You give PartnerPage the email domains that should log in through SSO. PartnerPage can add people who log in for the first time to your organization with a default role, so they don't have to ask to join.
SSO for your partners. Partners log in with the account they already have in your identity provider, for example the one they use for your partner portal. PartnerPage matches each person to their partner profile by External ID: the partner's ID in your own system, stored on the External ID card of the profile in Partners (PartnerPage switches that card on for your directory). After login, the partner lands straight on that profile. If no profile matches, the connection can create the partner's company and profile from the company name, external ID, first name and last name your identity provider sends. If a company with the same email domain already uses PartnerPage, the person is offered to join it first.
In both cases PartnerPage trusts your identity provider for the email address, so SSO users skip the email verification step.
Set up a SAML 2.0 connection
To set up a SAML 2.0 connection, send your PartnerPage contact all of the following:
Sign In URL: the URL where SAML authentication requests are sent, also called the single sign-on (SSO) endpoint.
Sign Out URL: the URL where SAML logout requests are sent, also called the single logout (SLO) endpoint.
X509 Signing Certificate: your identity provider's public-key certificate, in .pem or .cer format. Auth0 uses it to check the signature on the identity provider's assertions.
Email domains: every email domain that should log in through SSO. Most companies use one; list all of them if you have subsidiaries or contractor domains.
Email attribute: confirmation that your identity provider sends the user's email in the SAML attribute
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
PartnerPage then sends you the values for your identity provider, with your connection name in place of <SAML_CONNECTION_NAME>:
Assertion Consumer Service URL (post-back URL):
https://login.partnerpage.io/login/callback?connection=<SAML_CONNECTION_NAME>Entity ID:
urn:auth0:outwork:<SAML_CONNECTION_NAME>Metadata file, if your identity provider imports SAML settings from XML:
https://login.partnerpage.io/samlp/metadata?connection=<SAML_CONNECTION_NAME>
The other standard SAML settings for PartnerPage are:
Setting | Value |
Protocol binding | HTTP-POST |
Sign request algorithm | RSA-SHA256 |
Sign request algorithm digest | SHA256 |
PartnerPage certificate |
Set up an OIDC connection
To set up an OpenID Connect (OIDC) connection, send your PartnerPage contact:
OpenID Connect Discovery URL: your identity provider's well-known discovery endpoint.
Client ID: the public identifier of the PartnerPage application you created in your identity provider.
Client Secret: the key that goes with the Client ID. Share it securely: it is sensitive.
If your identity provider has no discovery URL, send an OpenID Connect metadata file (a JSON file of the configuration) instead. PartnerPage supports back-channel OIDC connections.
How people log in once SSO is on
Once SSO is on, your team members log in to PartnerPage the way your company set up, usually through your company's sign-in page. Partners log in the way you set up with PartnerPage, usually through your identity provider's sign-in page or a link you share with them, for example in your partner portal. After login, partners land on their partner profile. Your IT team can confirm how your connection is set up.
Common questions
Can I set up SSO myself in the PartnerPage dashboard?
No, PartnerPage SSO is not self-serve. The PartnerPage engineering team creates every SAML or OIDC connection from the details your IT team sends.
Do people who log in with SSO need to verify their email?
No. PartnerPage treats email addresses from your identity provider as verified, so SSO users go straight to the dashboard.
How does PartnerPage know which partner profile an SSO user belongs to?
PartnerPage matches the External ID your identity provider sends with the External ID on the partner's profile in your directory. Make sure each partner profile has the right External ID before you switch on partner SSO.
Related: Log in to PartnerPage