This article discusses functionality that is included in the Aha! Knowledge Advanced plan. Please contact us if you would like a live demo or want to try using it in your account.
Google Cloud Identity single sign-on makes it easy for your organization to access the documentation they need — without having to remember another user name and password.
Click any of the following links to skip ahead:
When a user navigates to the knowledge base, they will be presented with the option to authenticate to the knowledge base via SSO only. If they are already logged in to the SSO provider, they will automatically be logged in to your knowledge base without any additional actions.
To set up Cloud Identity single sign-on you will need to be both an admin for your Cloud Identity account as well as an admin for your Aha! Roadmaps account.
The first step is to create a knowledge base in Aha! Roadmaps by navigating to Settings ⚙️ Account Knowledge bases or from the Share menu on a workspace document. You need to be subscribed to the Aha! Knowledge Advanced plan to do this.
Once you create your knowledge base, its knowledge base settings will open in a new tab. Navigate to Overview Access and select SSO from the Authentication dropdown.
In the SSO identity provider dropdown, select Add new provider.
Add a Name for your configuration and choose SAML as your identity provider Type. Click Save.
The SAML 2.0 configuration will display
Select Metadata file next to Settings using. You will generate a metadata file to use here shortly from within your Google Cloud Identity account.
Next, log into your Cloud Identity account.
Navigate to the Apps menu and select SAML Apps Add a service/App to your domain Setup my own custom App.
Next you will be given the option to manually configure Google as your identity provider or to use a IDP metadata file. We recommend using the metadata file as you can upload it directly to Aha! Roadmaps to handle the Aha! Roadmaps side configuration. Click Download to download the metadata file.
You will be prompted to enter a name for your app and provided the option to upload an image. You can name the app whatever you want.
After naming your app you will be prompted to provide the ACS URL and the Entity ID. Both of these are located within your account in SSO settings by navigating to Settings ⚙️ Account Knowledge Single sign-on and selecting your Google Cloud Identity configuration.
You will also want to select EMAIL as the Name ID Format value on this page.
After entering the ACS URL and Entity ID you will be prompted to set up attribute mapping. You want to define EmailAddress, FirstName and LastName as shown below. Those three values are required for Aha! Roadmaps SAML SSO.
Back in your Aha! account, you will need to take the metadata file you downloaded from Cloud Identity and upload it to the Metadata file field. This will allow you to upload the metadata file which will provide Aha! Roadmaps the information it needs to connect to your Cloud Identity SSO configuration.
Lastly, enable the app you created in Cloud Identity by selecting the ON for everyone option.
New apps can take up to 24 hours to fully activate for all users in Cloud Identity. Users attempting to log on prior to the app fully activating may be presented with a login error: "403 error app_not_configured_for_user." This should resolve itself within 24 hours.
Beneath Access for Aha! users, you will find two additional advanced settings. These are disabled by default for knowledge base SSO configurations, as they are intended for ideas portal SSO configurations.
Most Aha! accounts will not need these advanced settings — and you can break your SSO configuration if you do not use them correctly. If you are also using this configuration for both your knowledge base and your ideas portal and you need help configuring these options, you are welcome to reach out to our Customer Success team.
Enable CNAME for SSO URLs: This option is rarely needed and will break SSO if not carefully configured. Enabling this option causes SSO to use the CNAME as well. This is not necessary for knowledge bases or for most ideas portals, even when using a CNAME for the portal. It may be useful if your customers have strict corporate networking policies.
CNAME: This must match an existing CNAME used in an active ideas portal in your Aha! account. After adding the CNAME click Update URLs and Save or Update SSO. If you have previously configured SSO the URLs must be updated in your external system.
We have created an article to help you , complete with explanations and resolutions.
The best place to start in most of these situations is the Recent SSO events for your SSO configuration, at the bottom of the configuration page. Those messages will help diagnose and solve the problem.
It is possible to invite an ideas portal user from your ideas portal settings who has not been configured with the identity provider your portal is using. The user will not be able to log in to the ideas portal until they can be authenticated by the identity provider.
If you get stuck, please reach out to our Customer Success team. Our team is made up entirely of product experts and responds fast.