New Voice

Solved

Can SSO be bypassed?

Forum|Forum|2 years ago
February 6, 2024
4 replies
1795 views

We are going over our external password policies. One question I am unable to find the answer is “If we have SSO enable. Is there a way to sign in with a user name / password bypassing SSO?

Best answer by David.Schmitz

@msienko It depends on your SSO settings in Domains that have been claimed. There are options to allow Users to be created that bypass SSO and there is a specific checkbox on a Domain stating “Require all users to log in with SSO only”, if that is not checked then a new User could be created that uses a Username and Password that is not bound by SSO.

The setting can be checked by any Account Admin.

Sidenote: If you are DocuSign Admin and you go to Add User, then see this message when you get to the “Security” option, “The default login policy for this email domain does not require all users to log in via SSO”. Then it is very likely that the SSO only” is not enabled at least for the email domain you are attempting to add.

D

David.Schmitz

Answer

Hero

@msienko It depends on your SSO settings in Domains that have been claimed. There are options to allow Users to be created that bypass SSO and there is a specific checkbox on a Domain stating “Require all users to log in with SSO only”, if that is not checked then a new User could be created that uses a Username and Password that is not bound by SSO.

The setting can be checked by any Account Admin.

Sidenote: If you are DocuSign Admin and you go to Add User, then see this message when you get to the “Security” option, “The default login policy for this email domain does not require all users to log in via SSO”. Then it is very likely that the SSO only” is not enabled at least for the email domain you are attempting to add.

M

msienko

Author

New Voice

Thank you that was very helpful!

Michael.Rave

Docusign Employee

@msienko

In addition to that we recommend to set up the Administrator users to be able to bypass SSO at any time to be able to fix issues with the SSO configuration, which prevents login, e.g. the certificate of your identity provider expired.

In order to do so, you need to change the Login Policy for all Admin users from “Default” to:

“Log in with SSO (if an identity provider is mapped to the domain), password, or passwordless login options”

If the external users are using your claimed company domain, but they are not able to use SSO, e.g. because they are not in your IdP, you need to change their login policy as well to grant them access to DocuSign.

If the external users are not using your claimed company domain, you cannot configure their SSO settings. Their SSO settings apply if the domain was claimed, e.g. if you send an envelope to a @docusign.com email address it will honour the configuration of the docusign.com domain and not what you have configured. If they use a free email address, they will not have an SSO option and need to login with a password.

"Select as Best" below if you find my answer is a valid solution to your issue and mark it as resolved.

C

Christopher.Alpizar

Docusign Employee

Hi @msienko,

I hope you are doing well.

I would like to confirm if you were able to solve your issue by utilizing the solution that was suggested or if the information that was provided was useful.

If so, please mark it as the best answer by clicking “Select as Best” to make it easier for other users to find.

Otherwise, feel free to let me know and I will gladly help you address the situation as soon as possible.

Best regards,

Christopher | DocuSign Community Moderator

"Select as Best" below if you find the answer a valid solution to your issue.

Sign up

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.

Docusign Community

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.