This article explains how to set up Single Sign-On (SSO) for Big Think+ with any identity provider that supports SAML 2.0.
Use this guide if your identity provider (IdP) does not have its own Big Think+ guide. It applies to PingIdentity, OneLogin, JumpCloud, ADFS and other SAML 2.0 providers.
What do I need before I start?
- Administrator access to your IdP, with permission to create SAML applications.
- Your Big Think+ organization permalink, provided by your Big Think+ Partner Services contact. Wherever this page shows
<permalink>, replace it with yours. - The email domains your users sign in with (for example,
yourcompany.com).
What values do I enter in my identity provider?
| Setting | Value |
| SP metadata URL | https://plus.bigthink.com/o/<permalink>/auth/saml/metadata |
| ACS URL (also called Reply URL, Single sign-on URL or Recipient) | https://plus.bigthink.com/o/<permalink>/auth/saml/acs |
| SP Entity ID (also called Audience or Identifier) | plus.bigthink.com |
| Name ID format | Email address |
| Name ID value | The user's email address |
If your IdP can import SP metadata, give it the SP metadata URL and it will fill in the ACS URL and Entity ID for you. If you enter them by hand, note that the ACS URL ends in /acs, not /metadata.
Can I send other user details?
Email is the only value Big Think+ requires. If you want first and last names in Big Think+ analytics, send them as attributes with any names you choose and tell Partner Services which names you used.
How do I set up the connection?
- In your IdP, create a SAML 2.0 application named Big Think+ using the values above.
- Email your Partner Services contact (or partnerservices@bigthink.com) with:
- Your IdP metadata, as a URL if your IdP provides one, otherwise as an XML file. A URL is preferred because Big Think+ can pick up changes from it; an XML file must be resent whenever your signing certificate changes.
- The email domains your users sign in with. Big Think+ uses these to send users to your IdP from the sign-in page.
- The email address of your first Big Think+ admin. That person signs in once through SSO, and Big Think+ promotes them to admin.
- After Partner Services confirms your metadata is loaded, assign the Big Think+ app to the users or groups who should have access. Anyone your IdP lets sign in gets a Big Think+ account the first time they sign in, so assign only licensed users.
- Test both ways:
- From your IdP (IdP-initiated): click the Big Think+ tile in your IdP's portal.
- From Big Think+ (SP-initiated): open
https://plus.bigthink.com/o/<permalink>in a private browser window.