Dotdigital's single sign-on, SSO, feature uses a standard called OpenID Connect. When an account user logs in with SSO, an OpenID handshake is initiated with the user's identity provider, IdP. Once the IdP authenticates the user, they're redirected back to Dotdigital, where their details are validated and they're granted access to their account.
Learn more about OpenID on the OpenID connect website.
Set up single sign-on (SSO)
This article focuses on the technical process behind Dotdigital's SSO feature. To learn how to set up SSO, log in to your Dotdigital account and read Set up single sign-on (SSO).
Understand single sign-on
The SSO login process follows these steps
The account user enters their email address into the Dotdigital login form.
The system recognises the account as SSO-enabled and redirects the user to their IdP.
The user is prompted to sign in at their IdP.
The following user details are also requested from the IdP:
openid
profile
email
phone
offline_access
After successfully signing in, the IdP sends the user's details to the system.
The user's details are validated using OAuth tokens.
The system then confirms that the user logging in matches the details received. To do this, it checks the user information and ID token provided by the IdP, and matches the email address against one of the following:
email
upn
unique_name
preferred_username
emails (we split this into a comma-delimited list and check all of them)
After validating the user, the session starts and they're directed to their account dashboard.