Sign-in with the company account (SSO)

For CROs and sponsors: signing in through the company's provider, connecting it, closing password sign-in.

For CROs and sponsors that run their own sign-in service (Keycloak, Microsoft Entra ID, Google Workspace, ADFS, Okta, Shibboleth, Yandex 360: any OpenID Connect or SAML 2.0 server). People sign in to YouEDC with their work account and their company's own second factor, without a separate password for signing in.

How to sign in

The person signs in at their company; the portal checks the answer and lets in only addresses of the company's domains.

On the sign-in page press “Sign in with your company account”.
Enter your work e-mail and press “Continue to my company”. Your company's sign-in page opens.
Sign in there as usual, with the second factor if you have one. The portal brings you back to the desk, signed in.

If you have no YouEDC account yet and the Portal Owner allowed accounts at the first sign-in, the portal asks you to check your name and accept the personal data consent, as at an ordinary sign-up. Without the consent no account is made.

How to connect a company

The Portal Owner does it in Administration › SSO.

The company's IT department makes an OpenID Connect client (confidential, authorization code) in its provider and gives it the redirect address shown on the SSO page.
The Portal Owner enters the name, the company's e-mail domains, the provider's address (issuer), the client ID and secret, then presses “Check the provider”.
One person of the company signs in as a test. Then “Close password sign-in for these domains” may be switched on.

Connecting over SAML 2.0

Many companies, in the US and Germany above all, give only SAML (ADFS, Microsoft Entra ID, Okta, Shibboleth, Keycloak). Choose SAML 2.0 as the protocol of the connection.

Give the company's IT department the portal's SAML metadata: the “Download the SP metadata” button on the connection's page, or its address. It holds the portal's entity ID, the Assertion Consumer Service address (HTTP-POST) and the certificate that signs the portal's requests.
They set the portal up as a relying party (service provider) with signed assertions (SHA-256), without assertion encryption, and with the e-mail as NameID or as an attribute (email, mail or emailaddress).
They send you their provider's metadata. Paste the XML, upload the file or give its https address, and save. The portal reads the provider's entity ID, its sign-in address and its signing certificates from it.
When the provider renews its certificate, press “Read the metadata again” (with an address) or paste the new metadata. The connection page shows each certificate's expiry date.

Encrypted assertions are not used. The answer travels to the portal over TLS only; ask the IT department to sign the assertions and switch encryption off (the default in ADFS, Entra ID and Keycloak). An encrypted answer is refused with this advice.

Add a domain only when it surely belongs to the company. Whoever runs the provider can sign in as any address of those domains. A domain can be connected to one company only.

What the portal checks

The sign-in was started in this very browser (state, PKCE S256) and is not replayed (nonce); the answer came within 10 minutes.
The answer was issued by this provider (issuer) for YouEDC (audience) and has not expired. It is taken straight from the provider over a secure connection.
With SAML 2.0: the answer is signed with the provider's certificate from its metadata (the assertion or the whole answer; SHA-1 is refused); only the signed part is read, so a forged assertion slipped next to a signed one does not get in; the issuer, the audience (the portal), the recipient address, the request this browser sent (InResponseTo) and the validity times are checked; an assertion is accepted only once; a document with a DTD or entities is refused.
The e-mail belongs to the company's domains. Another address does not get in, even if the provider sends it.
A blocked account, or one waiting for approval, does not get in through the company either.

The account link, every sign-in and every change of the settings go to the audit trail. The client secret is never shown after saving and never goes to the audit trail.

The password and electronic signatures

Portal Owners always keep password sign-in, so a broken provider can never lock everyone out.
A lock after wrong passwords does not stop sign-in through the company: a stranger guessing the password cannot throw the person out.
An electronic signature under 21 CFR Part 11 still needs the portal password. If the account was made at a sign-in through the company, set the password with “Forgot the password?” before the first signature.

Legality. Connect only a provider the company may lawfully use in the country of this installation. The portal asks the provider only for the name and the e-mail (openid, email, profile; with SAML the NameID and the e-mail and name attributes).