Connect your company login for single sign-on

Single sign-onSingle sign-on (SSO) Signing in through your firm's own company login instead of a sign-in code, set up for your email domain on the Enterprise plan. lets people at your firm sign in through your company login instead of a sign-in codeSign-in code A 6-digit code sent to your email or phone each time you sign in, so no password is needed; it expires after 10 minutes.. Your company login must be a SAML 2.0 identity providerIdentity provider The service that runs your firm's company login, such as Okta or Microsoft Entra ID, and confirms who someone is for single sign-on., such as Okta or Microsoft Entra ID. You connect it to a verified email domain, usually with your IT team.

1. 1

   Open the domain's Edit page

   In Domains, on the Active tab, open the domain's Action menu and choose Edit.

2. 2

   Copy the single sign-on address

   Copy the domain's single sign-on address with the copy button beside it. In your company login, it's both the reply URL, also called the ACS URL, and the entity ID, also called the audience. Each domain has its own address, so each needs its own app in your company login.

3. 3

   Set up the company login

   In your company login, create a SAML 2.0 app with that address, and set it to:

   • sign the assertion itself, not only the response;
   • send each person's email address as the name ID, or in an attribute named Email, and only addresses on this domain;
   • accept sign-in requests by redirect, at an https address, without requiring them to be signed;
   • leave assertion encryption off.

   To fill in the name, language and time zone of someone's new account, also send attributes named GivenName, FamilyName, Locale and ZoneInfo. Then download the app's metadata as an .xml file.

4. 4

   Upload the metadata

   Back on the domain's Edit page, under SAML Identity Provider Metadata, choose the .xml file, then Submit. "Domain Edited" shows.

5. 5

   Switch single sign-on on

   On the Active tab, turn on the domain's Sso switch. It stays greyed out until metadata is saved.

6. 6

   Test it

   In a private browser window, open https://account.caseactive.com/sso/ followed by your domain, such as https://account.caseactive.com/sso/smithlaw.com, and sign in to your company login. You land on the Hubs page, signed in.

What happens next

Switching single sign-on on changes no sign-in page. People start from your company login's own app list, or from the address in the last step. To make it the only way in, see Require single sign-on for your email domain.

• Single sign-on doesn't add anyone to a hubHub Your law firm's own client portal, with its branding, its team and all of its cases in one place.. Someone with no account gets one on their first sign-in and is asked to confirm their profile. Their Hubs page stays empty until an Admin adds that work address in Users; see Add a team member.
• To have your company login's app open your hub, set the app's default RelayState to the hub's portal or Admin Panel address. Keep it to the hub's own address, since SAML allows only 80 characters. An address outside CaseActive is ignored, and people land on the Hubs page.
• Reset, in the domain's Action menu, switches single sign-on off, as the switch does, and keeps the metadata and settings.
• When your company login's signing certificate changes, upload its new metadata, or every sign-in through it fails.

If something goes wrong

• You're back on the sign-in page, with no message. The hub refused your company login's answer. Check that it sends an address on this domain, that it signs the assertion, and that the metadata you uploaded is the current one.
• "This file can't be read as company login metadata. Download it again from your company login and upload it here." Download the metadata .xml again and upload it. A file whose sign-in address isn't https is refused the same way.