SAML / SSO - Setup guide

What is SSO

Single sign-on is an authentication solution allowing users to sign in to multiple systems using one set of credentials, companies benefit from this authentication scheme for multiple reasons including but not exclusive to,

• Security

• Time management

• User experience

Benefits of using SSO

When using SSO, External Share will allow users to securely create and access accounts with minimum required credentials. Thanks to the use of a federated data system, it is possible to tighten security while making it convenient for users to access data.

Managing multiple SSO configurations

External Share supports multiple SSO/SAML configurations. This allows admins to integrate various identity providers (IdPs) and provide flexible authentication options depending on the workspace or specific sharing needs.

• Global SSO Management: Create, edit, and manage multiple SSO configurations from the Global Settings sidebar.

• Space-Specific SSO: Assign specific SSO configurations to individual Confluence spaces via Space Configuration.

• Flexible External Share Authentication: When creating an external share, users can select suitable SSO configuration to authenticate end-users.

How to enable SSO on External Share

1. Navigate to External Share -> SSO Configuration tab.

2. Click Create New Configuration and provide your Identity Provider (IdP) details, including metadata and domains.

3. (Optional) Go to Spaces Configuration to restrict which SSO options are available for specific spaces.

4. When creating a shared link, enable SAML/SSO under security settings and select the desired configuration from the picker.

 

Manage Workspace

The users who have signed in through this configuration. They are added the first time they sign in, so there is nothing to fill in here yourself, and you can search the list by name or email.

Their first name, last name, and email come from the attributes your identity provider sends. If names are missing from this list, check the attribute statements in your IdP setup.

Where users land after signing in

By default, a user who signs in through SSO ends up on the dashboard. If your external users come to one particular shared page, you can send them straight there instead.

Open Global Settings → SSO Configuration, select a configuration, and fill in Landing page after sign-in. The field is empty by default, which keeps the current behaviour.

The value must be a full http or https address, and it must point to either a shared page on the application's own domain or a page on a custom domain you have enabled. Other addresses are rejected, and the validation message lists the domains you can use. A configuration with an invalid value cannot be saved until you correct it.

The setting belongs to each SSO configuration, so an instance with several configurations can send each audience to its own entry point.

Order of precedence

This also applies when someone activates a new account from a registration email, or connects an additional workspace. Signing in with a password or a login code is unchanged and still ends on the dashboard.

The dashboard remains reachable from the account menu.

If you later disable the custom domain a landing page points to, users fall back to the dashboard, and the value is flagged as invalid the next time you open that SSO configuration.

Require Corporate SSO login to access shared pages

After setting up the SSO, you may secure your shared pages by requiring external users to log in with single sign-on to access the page. This is especially useful when you share your Confluence content with coworkers that don’t have access to Confluence and you want to ensure that no information will leak outside your organization.

This option can be set on global and space levels as well as for a specific page.

---

Setting SSO Enforcement Levels

Require SSO login globally

Navigate to global settings:

1. Click on the “Apps” dropdown menu.

2. Select the “External Share”.

3. Click on Space configuration tab

4. Click on the “Edit default configuration” button

5. Select the “Security tab”

6. Select Optional or Required and Save

Require SSO login for a specific Space

1. Enter the Space

2. On the sidebar menu select the External Share option

3. Navigate to Space configuration

4. Security tab

5. Require Cooperate SSO login

6. Save

 

_{Please ensure the SSO login is set to optional on Global settings.}

Require SSO for a specific page

1. Open the page

2. Click on the “External Share” button located on the top right corner of the page

3. Click on the “Create External Share link”

4. Navigate to the security tab

5. require Corperate SSO Login

_{Please ensure the SSO login is set to optional on Space and Global settings.}