Skip to main content
Planview Customer Success Center

Use SSO with Projectplace

Enabling Single-Sign-On (SSO) for your Projectplace account allows users to authenticate using your existing SSO infrastructure instead of using a separate username and password for Projectplace. SSO is available free of charge for all Projectplace accounts.

How SSO Works with Projectplace

Projectplace supports two different ways to login to Projectplace when SSO is enabled: Service Initiated SSO and Identity Provider Initiated SSO.

If a user without a Projectplace user account logs in using your organization’s IdP, a new user account will be automatically created through a process called Just in Time (JIT) Provisioning.

Service Initiated SSO

The user experience when using Service Initiated SSO is very similar to when using a username and password. The user will go to the login page to login. When the user enters their username, Projectplace will identify that the user is supposed to authenticate using SSO and will redirect the user to the configured IdP. After successful authentication with the IdP, the user will be transferred back to Projectplace and logged in.

Identity Provider Initiated SSO

Most SAML Identity Providers offer a portal where users can access the apps that are available to them from a dashboard. The process of logging in to Projectplace this way differs from IdP to IdP; generally, users begin by going to the IdP and logging in with their user credentials. After successful authentication, the user will be presented with a list of available apps. After selecting Projectplace, the user will be sent to Projectplace and logged in.

SSO Requirements

SAML Identity Provider

Projectplace supports Single-Sign-On (SSO) through the SAML 2.0 protocol. To enable SSO, your organization needs to have a SAML identity provider (IdP). Some examples of SAML identity providers are:

  • Microsoft Active Directory Federation Service (ADFS)
  • Microsoft Azure Active Directory
  • Okta
  • OneLogin
  • PingOne Ping Identity

Install Projectplace SAML Metadata

Before requesting activation from Projectplace, install Projectplace’s SAML metadata in your IdP.

Request Activation

To request activation, the Projectplace account owner must open a new case with Planview Customer Care, either through the Customer Care Community or email. In your request, make sure to include the following information:

  • SAML Metadata URL: Your request must include a URL to the SAML metadata for your organization in the case. Projectplace will update the SAML configuration for your account daily, making certificate updates seamless. If your IdP does not expose the metadata through a URL, attach the metadata as a static XML file. In this case, you need to open a new case with Planview Customer Care every time the signing certificates need to be updated.
  • Enforced SSO Disablement: When SSO is enabled for a Projectplace account, all users must use the configured IdP for authentication. Logging in using a username and password is no longer allowed for users that belong to the account. However, there might be cases when this does not work for your organization; for example, when there are users that belong to the account but do not exist in the IdP. For this purpose, enforced SSO can be disabled in Projectplace. If this is the case for your organization, make sure to mention it when requesting activation for your account.
  • SSO Test Users: Projectplace supports a roll out SSO for a subset of the users on your account, in order to validate that the SSO integration is working properly. When requesting to have SSO activated, please include the username of one or a few test users that should have SSO enabled before it’s made available to all users. The activation for all users won’t happen until it’s confirmed that SSO is working correctly.

Required SAML Claims

To authenticate a user, Projectplace requires four SAML claims: Name ID, emailaddress, firstname, and lastname. The values of the Name ID and emailaddress claims must be the email address of the user. Please note that the same value should be provided for both claims. The firstname and lastname claims should contain the first and last name of the user.

If you want to send SAML Claims with a different attribute name, a custom attribute mapping between your IdP and Projectplace can be configured. If so, please include the attribute names that your IdP will use in the submitted case when requesting to have SSO configured for your Projectplace account.

In addition to the required claims, Projectplace does support several optional claims to populate a user’s profile; see the Supported SAML Claims section for more details.

All configured SAML claims are updated every time that a user is logged in to Projectplace. Say for example that a user has their last name changed in the IdP, then the last name in their Projectplace user profile will be updated the next time they log in to Projectplace. The exception to this is the Name ID and emailaddress claims since they are used to identify the user. If either of those fields is updated, the user will appear as a new user to Projectplace and a new user account will be created.

Supported SAML Claims

The following is the complete list of SAML Claims that are supported by Projectplace for populating values in a user’s profile.

Attribute Name

Required

emailaddress

Y

firstname

Y

lastname

Y

title

N

organization

N

department

N

mobilephone

N

homephone

N

workphone

N

streetaddress

N

streetaddress2

N

postcode

N

city

N

province

N

country

N

language

N

 


  • Was this article helpful?
Leave feedback