nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Single Sign On (SSO) button allows login with non-domain email?

Daniel Wallach

When a user clicks the SSO button at login but isn't using an email address with our registered domain, it still allows them to log in. In the case I tested, it was a Gmail address. After entering the email and click the SSO button, I'm brought to Google login and get in without issue.

I'm wondering if the system is actually checking the domain and automatically redirects as a feature (maybe I'm forgetting where that was mentioned in initial setup), or if there's an actual error letting non-domain emails through. We use Google Workspace for our SSO, and have a our claimed domain in Admin > Security > Authentication > Manage SSO settings > Claimed Domains.

#BBID #sso #singlesignon

Find more posts tagged with

Comments

Jessi Walters

@Daniel Wallach hi there! The SSO button is designed to help users who start on a non-myschoolapp page. If your users first enter their email at yourschool.myschoolapp.com, they're automatically redirected to a recognized domain IdP or to the appropriate alternative, based on what BBID knows about the email address.

If, however, someone happens to land on the page with the 4 authentication method buttons and select SSO, the login page will either A) recognize the claimed email domain and route them to that IdP or route them to sign in/up with Google, Apple, or email.

Jessi Walters

@Daniel Wallach similarly, if somebody tries to sign up through the email/Google route but they're on a claimed domain, they'll be routed through the SSO. Same song, different verse.

Daniel Wallach

@Jessi Walters
Thanks! Couldn't find confirmation of what happens when clicking SSO with a non-domain email in the KB, whether an error message or redirect to appropriate authentication method. It does happen occasionally that people land on the page with authentication mentiod choices.

With your clarification and testing I did with a demo account using a non-domain email, I now know what's happening on the user end and know my answers to them are reliable ?