Skip to main content

Setting Up Single Sign-On (SSO) for Your Organization

This article explains how to connect Caredove to your identity provider (IdP) so your team can sign in with their corporate credentials.

Written by Tina Krliu

About Caredove Single Sign-On (SSO)

SSO allows users to sign in using corporate credentials configured by their IT department rather than a separate password for Caredove. Credentials are managed by an organization identity provider (IdP) such as Microsoft Entra, Okta, Google Identity Services, etc.

Caredove supports two SSO methods:

  • Sign in with Microsoft - Microsoft's social sign-in method. No configuration or IdP setup required.

  • SAML 2.0 - Common IdP option for organizations that need a full enterprise SSO connection.

Limitations: SSO will not currently automatically provision new users who log in with SSO, deprovision users who have been deprovisioned in the IdP, or log out users who have been logged out at the IdP. These SCIM features are on the Caredove roadmap.

Before You Start

  • Users must already exist in Caredove with the same email addresses they have at your identity provider.

  • Email must match - the email your identity provider sends (the SAML NameID or email attribute) must exactly match the user's Caredove email.

  • You need admin access to your organization's Settings > Security page in Caredove, and admin access at your IdP.

Where to find the exact URLs: Every URL you need to register at your identity provider (the SAML ACS URL, SP Entity ID, and Metadata URL) is displayed for you in Settings > Security once you choose SAML. Always copy the values shown there - they are specific to your organization.

Method 1: Sign in with Microsoft

If you are a Microsoft user, you can use the Sign in with Microsoft social sign-in option without any configuration or IdP setup.

On the Caredove login page, click Sign in with Microsoft. If you have a matching Microsoft-hosted email with your Caredove account, you will be logged in (assuming you have an active Microsoft session).

This is the simplest sign-in method, but does not connect to your broader IdP ecosystem if you have one.

Method 2: SAML 2.0 Setup

What Your Identity Provider Needs from Caredove (Service Provider Details)

When you choose SAML in Settings > Security, Caredove shows a read-only Service Provider details block. Register these values at your identity provider:

Caredove label

SAML term (varies by identity provider)

ACS URL

Assertion Consumer Service / Reply URL / Single sign-on URL

SP Entity ID

Audience URI / Identifier / Entity ID

Metadata URL

SP metadata (some identity providers can import this directly)

These values are specific to your organization. Always copy the exact values from Settings > Security.

If your identity provider can import SP metadata by URL, point it at the Metadata URL and it will pull the ACS URL and Entity ID automatically.

What Caredove Needs from Your Identity Provider

Fill in the SAML section in Settings > Security:

Field

What it is

IdP Entity ID

Your identity provider's issuer/entity ID.

IdP SSO URL

Your identity provider's SAML single sign-on (login) endpoint.

IdP SLO URL (optional)

Single logout URL, if your identity provider supports it.

IdP X.509 Certificate

The identity provider's signing certificate (PEM/Base64). Caredove requires signed assertions.

Email attribute

The SAML attribute carrying the user's email. Defaults to NameID. Set to the attribute name (e.g. email) if your identity provider sends email as an attribute rather than the NameID.

Button label

The text on the sign-in button (e.g. "Sign in with SAML").

Shortcut: Click Upload IdP metadata XML and select the metadata file exported from your identity provider. Caredove parses it in your browser and pre-fills the Entity ID, SSO URL, certificate, and (if present) SLO URL. Review, then save.

SAML with Okta

  1. In the Okta Admin Console, go to Applications > Create App Integration > SAML 2.0. Next.

  2. Name the app ("Caredove") and continue to Configure SAML.

  3. Single sign-on URL: enter the ACS URL from your Caredove Settings > Security page.

  4. Audience URI (SP Entity ID): enter the SP Entity ID from Caredove.

  5. Name ID format: EmailAddress. Application username: Email.

  6. (Optional) Under Attribute Statements, add email mapped to user.email if you prefer to key on an attribute. Then set Caredove's Email attribute to email. Otherwise leave it as NameID.

  7. Finish the wizard. On the app's Sign On tab, open View SAML setup instructions (or Actions > View IdP metadata) to get the IdP SSO URL, IdP Issuer/Entity ID, and the X.509 certificate, or download the metadata XML.

  8. Assign users and groups.

  9. In Caredove, either upload the metadata XML or paste the SSO URL, Entity ID, and certificate. Save.

SAML with Microsoft Entra ID (Azure AD)

  1. In the Entra portal, go to Enterprise applications > New application > Create your own application ("Caredove", non-gallery). Create.

  2. Open the app, then go to Single sign-on > SAML.

  3. Basic SAML Configuration > Edit:

    • Identifier (Entity ID): the SP Entity ID from Caredove.

    • Reply URL (ACS URL): the ACS URL from Caredove.

  4. Attributes & Claims: ensure the email/NameID is released. The default Unique User Identifier (NameID) is usually user.mail or user.userprincipalname. Make sure it matches the user's Caredove email. Leave Caredove's Email attribute as NameID unless you map email to a named claim.

  5. SAML Certificates: download Certificate (Base64).

  6. From Set up Caredove, copy the Login URL (IdP SSO URL) and Microsoft Entra Identifier (IdP Entity ID). Or download the Federation Metadata XML and upload it to Caredove.

  7. Assign users and groups under Users and groups.

  8. In Caredove, upload the metadata XML or paste the Login URL, Identifier, and Base64 certificate. Save.

SAML with Google Workspace

  1. In the Google Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app.

  2. Name it ("Caredove"). On the Google IdP details screen, download the IdP metadata (or copy the SSO URL, Entity ID, and Certificate). Continue.

  3. Service Provider details:

    • ACS URL: the ACS URL from Caredove.

    • Entity ID: the SP Entity ID from Caredove.

    • Name ID format: EMAIL. Name ID: Basic Information > Primary email.

  4. (Optional) Add an Attribute mapping for email if you prefer an attribute over NameID. Then set Caredove's Email attribute accordingly.

  5. Finish, then turn the app ON for the right organizational units.

  6. In Caredove, upload the Google metadata XML or paste the SSO URL, Entity ID, and certificate. Save.

Testing and Troubleshooting

After saving, open the Caredove login page for a user in your organization. The SSO button (with your button label) should appear. Sign in with a test user that already exists in Caredove with a matching email. On success, you will be returned to Caredove, signed in.

Common Issues

Symptom

Likely cause and fix

"Account not recognized" after identity provider login

The user does not exist in Caredove, or the identity provider email does not match the Caredove email. Add or align the user first.

Reply URL mismatch error at the identity provider

The ACS URL registered at the identity provider does not exactly match. Re-copy from Settings > Security.

"Assertion not signed" or signature error

Caredove requires signed assertions. Enable assertion signing at the identity provider and paste the correct current X.509 certificate.

SAML works but email is wrong or empty

The email is in an attribute, not the NameID. Set Email attribute to that attribute's name.

Rotating Certificates

When your identity provider signing certificate is renewed, update it in Settings > Security and save. Certificates are stored encrypted and are write-only in the UI.

If you have any questions, please reach out to our Caredove support team for assistance.

Did this answer your question?