Single Sign-On (SSO) Authentication

You can configure Single Sign-On (SSO) authentication both for accessing your account and for taking surveys.

This enhances security, simplifies access, and allows automatic collection of respondent data (your employees).

This feature is available on "Premium" and "Enterprise" plans.

SSO Use Cases

1. SSO for Account Access - You and your employees can authenticate through your corporate Identity Provider (IdP) without entering passwords.
2. SSO for Survey Participation - Only users logged in through your company's IdP will be able to access the survey. You can configure automatic data transfer (ID, name, email) to responses.

SSO for Account Access

After configuring SSO for your account, all users in your organization will be able to log in using corporate authentication. No password required - they only need to authenticate on your side.

Please note that all users must be invited to your account through the "Participants" section

If an employee is not added to "Participants", they won't be able to access your account even with successful SSO authentication.

Setup Instructions:

1. Open Account Profile (configurable only by account owner).
2. Find the SSO Configuration block.
3. Fill in the fields:
   OpenID Connect (OIDC) Configuration URL - your IdP's configuration address.
   Client ID - client identifier.
   Client Secret - client secret key.
   
4. In the Automatically add data to responses section, select the fields to transfer (ID, name, email).

There's an additional option during setup: "Disable password login". When enabled, all account participants can only log in via SSO. Regular password login will be completely disabled.

Use this setting if you want to eliminate password login entirely and only allow corporate authentication.

Callback URLs for IdP Configuration

When configuring the application in your IdP (Okta, Azure AD, etc.), specify the following callback URLs:

https://api.surveyninja.io/api/auth/sso/callback https://api.surveyninja.io/api/auth/sso/render/callback

Enabling SSO for Surveys

You can configure surveys to be accessible only to users authenticated via SSO.

How to enable:

1. Open the desired survey in the Builder.
2. Go to Settings.
3. Find and enable the "Survey access via SSO" option.
4. Publish the survey.

When SSO authentication is enabled, participants will be redirected to the IdP login page before starting the survey. After successful login, they'll be automatically redirected to the survey start.

Data Transfer to Responses

If the "Automatically add data to responses" option is selected in SSO settings, data received from the IdP (such as respondent's name and email) will be automatically added to survey results.

This eliminates the need for participants to manually enter their data and prevents duplicate responses from the same participant.

SSO Setup Examples for Popular Providers

Below are basic steps for connecting OpenID Connect (OIDC) through popular IdPs.

Okta

1. Go to Okta admin panel:
   https://{your-domain}.okta.com/admin/apps/add-app
2. Click Create App Integration.
3. Select:
   Platform: Web
   Sign-in method: OIDC – OpenID Connect
   
4. Enter Login redirect URIs: https://api.surveyninja.io/api/auth/sso/callback https://api.surveyninja.io/api/auth/sso/render/callback
5. Copy Client ID and Client Secret and paste them into SSO settings in WebAsk profile.
6. In the Assignments section, assign users and groups that will have access.

Azure Active Directory

1. Open Azure Portal and go to Azure Active Directory → App registrations.
2. Click New registration.
3. Fill in the fields:
   Name: WebAsk SSO
   Redirect URI (Web):
   https://api.surveyninja.io/api/auth/sso/callback https://api.surveyninja.io/api/auth/sso/render/callback
4. After creating the application, copy:
   Application (client) ID - paste into Client ID
   Client Secret - create in Certificates & Secrets section
5. In API settings, allow access to email, name, and user identifier.
6. Save changes and test login.