Help

Single sign-on

Single sign-on lets the people on your team sign in to QuantiMeet with their work account: Microsoft Entra ID, Google Workspace, Okta, or any identity provider that speaks SAML 2.0. Your team's owner sets it up once, on your team's own address (yourteam.quantimeet.com).

BetaSingle sign-on is in beta. QuantiMeet's side is tested; the steps for each identity provider below follow that provider's own documentation. If a screen does not match, write to info@quantimeet.com.

What it does:

• A button on your sign-in page. Once it is on, your team's sign-in page shows Continue with single sign-on. Someone who types an address in one of your claimed domains, with no password, is sent to your identity provider too.
• New people join on their own. Someone in one of your claimed email domains who has no QuantiMeet account yet gets a member account the first time they sign in. They join as a member, never as an owner or admin.
• You can require it. When single sign-on is required, everyone whose address is in a claimed domain must sign in with your identity provider: their QuantiMeet password, and any other way in, stops working.
• The owner signs in with their password, always. Single sign-on is for your team's members. QuantiMeet never signs the owner in through the identity provider, so whoever runs your identity provider cannot sign in as the owner, and you can always get back in if your identity provider is down or set up wrong.
• No second code from QuantiMeet. After a single sign-on, QuantiMeet does not ask for its own two-factor code. Your identity provider's sign-in, with its own multi-factor checks, is what counts.

What it does not do yet:

• Sign-in that starts in your identity provider's app list. Every sign-in starts at QuantiMeet (the button, or the Sign-on URL below). A sign-in started from a tile that sends people straight from the identity provider is refused, with a message asking them to start on your sign-in page. Microsoft Entra ID's tile works when you give it the Sign-on URL (step 3 of its section below).
• Removing people for you. When someone leaves, remove them in your identity provider AND on your team's Members page in QuantiMeet. Removing them only in the identity provider stops their single sign-on, but not a QuantiMeet session they already have.
• Single logout, encrypted assertions, OpenID Connect and automatic provisioning (SCIM).

Before you start

• You need to be your team's owner in QuantiMeet.
• You need an administrator in your identity provider: in Microsoft Entra ID, a Cloud Application Administrator or Application Administrator; in Google Workspace, a super administrator; in Okta, an administrator who can add app integrations.
• Open Settings > Security > Single sign-on on your team's address, for example https://yourteam.quantimeet.com/settings/security/sso. It is not on quantimeet.com itself.

What QuantiMeet gives your identity provider

Step 1 of the settings page shows four values for your team, each with a Copy button. For a team at yourteam.quantimeet.com they are:

• Identifier (Entity ID): https://yourteam.quantimeet.com/api/qm/sso/saml/metadata
• Reply URL (Assertion Consumer Service URL): https://yourteam.quantimeet.com/api/qm/sso/saml/acs
• Sign-on URL (for the app's tile): https://yourteam.quantimeet.com/api/qm/sso/start
• Metadata URL: https://yourteam.quantimeet.com/api/qm/sso/saml/metadata

Always copy them from your own settings page: they carry your team's address.

What your identity provider must send back:

• The person's email address, as the Name ID in email format or as an attribute named email. It is how QuantiMeet finds the member, so it must be the address they use on QuantiMeet.
• A name (optional, used for a new member's account): a display name, or first and last names (firstName and lastName, or the claims Microsoft Entra ID sends by default).
• A signature with SHA-256 (SHA-512 also works) on the assertion, the whole response, or both.
• No encryption. Leave assertion encryption off.

Microsoft Entra ID

1. In the Microsoft Entra admin center (entra.microsoft.com), go to Entra ID > Enterprise apps > All applications and select New application, then Create your own application. Name it QuantiMeet, choose Integrate any other application you don't find in the gallery (Non-gallery), and select Create.
2. In the new app, under Manage, select Single sign-on, then SAML.
3. In Basic SAML Configuration, select Edit and fill in:
   • Identifier (Entity ID): QuantiMeet's Identifier (Entity ID).
   • Reply URL (Assertion Consumer Service URL): QuantiMeet's Reply URL.
   • Sign on URL: QuantiMeet's Sign-on URL. With it, the app's tile in My Apps starts the sign-in at QuantiMeet, which is what QuantiMeet accepts.
   • Leave Relay State and Logout Url empty. Select Save.
4. Attributes & Claims: the defaults work. They send each person's email address. Check that every person who will use QuantiMeet has their email address filled in, and that it is the address they use on QuantiMeet.
5. In SAML Certificates, copy the App Federation Metadata Url (or download the Federation Metadata XML). You paste it into QuantiMeet in a moment.
6. Under Users and groups, add the people or groups who should sign in to QuantiMeet.
7. Test from QuantiMeet (below), not with the Test button in Microsoft Entra ID: QuantiMeet's test tells you exactly what a real sign-in would do, without signing anyone in.

When Microsoft Entra ID's signing certificate is renewed (it emails you 60, 30 and 7 days before it expires): right after you make the new certificate active, save your metadata again in QuantiMeet (step 2, Replace). Until then, single sign-on fails for everyone except through your own password.

Google Workspace

1. Sign in to the Google Admin console (admin.google.com) as a super administrator and go to Apps > Web and mobile apps. Select Add app > Add custom SAML app.
2. Give the app the name QuantiMeet and select Continue.
3. On the Google Identity Provider details page, download the metadata (Download Metadata) and select Continue. You paste the file's contents into QuantiMeet in a moment.
4. In Service provider details, fill in:
   • ACS URL: QuantiMeet's Reply URL.
   • Entity ID: QuantiMeet's Identifier (Entity ID).
   • Start URL: leave it empty.
   • Signed response: either setting works.
   • Name ID format: EMAIL, and Name ID: the person's Primary email.
   • Select Continue.
5. Attribute mapping (optional): map First name to firstName and Last name to lastName, so new members get their name. Select Finish.
6. Turn the app on: on the app's page, open User access, choose ON for everyone (or for the organizational units or groups who use QuantiMeet), and select Save. Google says a change can take up to 24 hours, though it is usually quicker.
7. Test from QuantiMeet (below). Google's own Test SAML login, and the QuantiMeet tile in Google's app list, start the sign-in at Google, which QuantiMeet refuses: your people start from your team's sign-in page.

Okta

1. In the Okta Admin Console, go to Applications and select Create App Integration. Choose SAML 2.0 and select Next.
2. In General Settings, name the app QuantiMeet and select Next.
3. In the SAML settings, fill in:
   • Single sign-on URL: QuantiMeet's Reply URL. Keep Use this for Recipient URL and Destination URL selected.
   • Audience URI (SP Entity ID): QuantiMeet's Identifier (Entity ID).
   • Default RelayState: leave it empty.
   • Name ID format: EmailAddress, with an Application username that is the person's email address.
   • Response and Assertion Signature: signed. Signature Algorithm RSA-SHA256 and Digest Algorithm SHA256. Assertion Encryption: unencrypted.
   • Attribute Statements: email with the value user.email, and for names firstName (user.firstName) and lastName (user.lastName).
   • Finish the wizard.
4. On the app's Sign On tab, under SAML Signing Certificates, open the active certificate's IdP metadata and copy its address (or its XML). You paste it into QuantiMeet in a moment.
5. On the Assignments tab, assign the people or groups who should sign in to QuantiMeet.
6. The QuantiMeet tile on your people's Okta dashboard starts the sign-in at Okta, which QuantiMeet refuses. Hide the tile, and have people start from your team's sign-in page.

Other identity providers

Any SAML 2.0 identity provider works if it can: take QuantiMeet's Identifier (Entity ID) and Reply URL (or read QuantiMeet's Metadata URL), sign with SHA-256, send the email address as described above, and give you its own metadata as a URL or an XML file. QuantiMeet signs its sign-in requests; its certificate is in step 1 of the settings page, under QuantiMeet's signing certificate for your team, if your identity provider asks for it.

Turn it on in QuantiMeet

1. Step 2, Save your identity provider's metadata. Paste the metadata URL, or paste the XML, and select Save. The page then shows which identity provider you saved, where it signs people in, and how long each of its certificates is valid.
2. Step 3, Test. Select Run a test sign-in and sign in at your identity provider, as yourself or a colleague. You come back to the settings page with the result: who signed in, what a real sign-in would do with that address, and which attributes arrived. Nobody is signed in to QuantiMeet by a test. A test with your own address shows that a real single sign-on would refuse it: you, the owner, sign in with your password.
3. Step 4, Claim your email domains. Add each domain your people's addresses use, for example yourclinic.com (up to 20). Single sign-on never signs in an address outside your claimed domains. Domains anyone can sign up for, such as gmail.com or outlook.com, cannot be claimed.
4. Turn on single sign-on (at the top, under Status). Your sign-in page now shows Continue with single sign-on.
5. Require single sign-on (optional, once a domain is claimed). Everyone whose address is in a claimed domain must then sign in with your identity provider. Your own password keeps working, and so do the passwords of members whose addresses are outside your claimed domains. Stop requiring it undoes this.

What your members see

• On https://yourteam.quantimeet.com/auth/login, the Continue with single sign-on button. Typing a work address in a claimed domain with no password and pressing Sign in does the same.
• After signing in at your identity provider, they land in QuantiMeet. The first time, their member account is created.
• When single sign-on is required and they type a password, they see: "Your team signs in with single sign-on. Use the button below, or ask your team's owner."
• If something stops them, the sign-in page says what, for example "That address is not part of your team's single sign-on. Ask your team's owner." or "Your account on this team is turned off. Ask your team's owner."
• If you, the owner, press Continue with single sign-on, your identity provider signs you in and QuantiMeet then says "Your team's owner signs in with their email and password.": use your password.

When something goes wrong

• The test did not pass. The result says why, for example that the Identifier or Reply URL in your identity provider is not the one in step 1, that the response was not signed with SHA-256, that it was encrypted, that no email address came with it, or that the identity provider's clock is off. Fix that setting and test again.
• Your identity provider is down, or its settings changed. Sign in with your own password, then turn single sign-on off or stop requiring it until it is fixed.
• Its certificate changed. Save its metadata again (step 2, Replace). An expired certificate shows in red.
• You want to stop using single sign-on. Remove identity provider turns single sign-on off, and everyone signs in with a password again. Members who joined through single sign-on have no QuantiMeet password: they set one with Forgot password on your team's sign-in page.