Single Sign On (SSO) button allows login with non-domain email?

Daniel Wallach
Daniel Wallach
Sixth Anniversary Kudos 2 Name Dropper Facilitator 1
in Blackbaud K–12 Education Solutions™ General Discussions

When a user clicks the SSO button at login but isn't using an email address with our registered domain, it still allows them to log in. In the case I tested, it was a Gmail address. After entering the email and click the SSO button, I'm brought to Google login and get in without issue.

I'm wondering if the system is actually checking the domain and automatically redirects as a feature (maybe I'm forgetting where that was mentioned in initial setup), or if there's an actual error letting non-domain emails through. We use Google Workspace for our SSO, and have a our claimed domain in Admin > Security > Authentication > Manage SSO settings > Claimed Domains.

#BBID #sso #singlesignon

Comments

  • Jessi Walters
    Jessi Walters Blackbaud Employee
    Seventh Anniversary Kudos 5 Name Dropper Participant

    @Daniel Wallach hi there! The SSO button is designed to help users who start on a non-myschoolapp page. If your users first enter their email at yourschool.myschoolapp.com, they're automatically redirected to a recognized domain IdP or to the appropriate alternative, based on what BBID knows about the email address.

    If, however, someone happens to land on the page with the 4 authentication method buttons and select SSO, the login page will either A) recognize the claimed email domain and route them to that IdP or B) route them to sign in/up with Google, Apple, or email.

    Sign in/up workflows were designed with the least technically savvy users in mind :)

  • Jessi Walters
    Jessi Walters Blackbaud Employee
    Seventh Anniversary Kudos 5 Name Dropper Participant

    @Daniel Wallach similarly, if somebody tries to sign up through the email/Google route but they're on a claimed domain, they'll be routed through the SSO. Same song, different verse.

  • Daniel Wallach
    Daniel Wallach
    Sixth Anniversary Kudos 2 Name Dropper Facilitator 1

    @Jessi Walters
    Thanks! Couldn't find confirmation of what happens when clicking SSO with a non-domain email in the KB, whether an error message or redirect to appropriate authentication method. It does happen occasionally that people land on the page with authentication mentiod choices.

    With your clarification and testing I did with a demo account using a non-domain email, I now know what's happening on the user end and know my answers to them are reliable ?

Categories