--- title: "SSO" slug: "configure-sso" updated: 2026-08-07T19:53:56Z published: 2026-08-07T19:53:56Z canonical: "docs.revealdata.com/configure-sso" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt > Use this file to discover all available pages before exploring further. # SSO Logikcull Public Records Requests supports single sign-on (SSO). You can turn SSO on or change your SSO settings in **Settings** > ![SSO icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LKK_SSO icon.png) **SSO**. ## Before you begin This workflow requires coordination with your IT department and your identity provider (IDP). **IT Department** Your IT department should let you know whether or not you use Active Directory Federation Services (AD FS) / Shibboleth / XML metadata or instead have a Discovery URL / Client ID / Secret. This will determine whether you’ll be setting up a **SAML** or **OpenID** protocall. **IDP** Your IDP should send you the appropriate URLs and IDs to fill into specific fields. You’ll also need to send your IDP one or more links from your Logikcull instance. See ## Choose SSO protocol Choose between SAML or OpenID protocols depending on your IDP’s capabilities and available configuration artifacts. - **SAML** - Choose SAML if you use Active Directory Federation Services (AD FS), Shibboleth, or XML metadata. - **OpenID Connect** - Choose OpenID Connect if you have a Discovery URL or a Client ID / Secret. ## Configure and enable IDP Instructions vary slightly depending on the protocol you’re using. ### Enable SAML 1. Send the below two URLs to your service provider. They can be found under **Service provider Details** and copied using the ![copy icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Copy icon.png) copy icon. ![Service provider details including SP Metadata and ACS URLs for identity provider.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Service provider details_Jun26.png) - **SP Metadata URL** – A URL on your application that describes your SAML configuration to the identity provider, allowing the identity provider to set itself up automatically. - **Assertion Consumer Service (ACS) URL** – The URL on your application where the identity provider sends the user after a successful login, along with their authentication details. 2. Fill the **Identity Provider Configuration** section. Your identity provider should provide you with all the information in this section. ![Configuration settings for Identity Provider including URLs and certificate details.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPD_Identity provider configuration_Jun26(1).png) 1. **IdP Entity ID**: The globally unique name that identifies the identity provider in the SAML exchange. 2. **SSO URL**: The identity provider’s login page URL, where users are sent to authenticate. 3. **SLO URL**: Optional. The identity provider’s logout URL, used to sign users out across all connected applications simultaneously. > [!NOTE] > Note > > Not all identity providers support SLO; some applications are fine logging the user out locally. If you leave this blank, signing out will only log the user out of your *application*, not out of their identity provider or any other connected apps. 4. **X.509 Certificate**: A certificate from the identity provider that your application uses to verify that incoming login responses are legitimate and untampered. 5. **Name ID Format**: The format the identity provider uses to identify the logged-in user in the SAML assertion. 3. Click the grey ![toggle icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Toggle off icon.png) toggle to turn on **Just-in-Time provisioning** (JIT), which automatically creates accounts for new users that authenticate using SSO. ![Settings for Just-in-Time Provisioning and Default JIT role selection for users.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_JIT provisioning_Jun26.png) 1. **Default JIT Role**: Select which permission level you want to automatically provide users once their account is created through JIT. For a list of permission levels and their descriptions, please see [Permission Levels: Overview](/logikcull-for-public-records/docs/permission-levels-overview). > [!WARNING] > Important > > When JIT is off, new users won't automatically get an account in the application the first time they log in – someone will need to manually create it for them first. This is useful in larger organizations where identity provider access and app account setup are handled by different individuals / teams, or if it’s preferred that user roles are assigned manually. 4. Scroll to the top of the page and click the **Enable** button to turn on SSO. ![SAML Single Sign-On configuration instructions with an enable button for SAML.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Enable SSO_Jun28.png) ### ### Enable OpenID Connect 1. Send the below URL to your service provider. It can be found under **Redirect UI** and copied using the ![copy icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Copy icon.png) copy icon.![Redirect URI for callback registration with identity provider displayed in the image.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LGK_Redirect UI_Jun26.png) 1. **Redirect UI** – The URL on your application where the identity provider sends the user after a successful login, along with their authentication details. 2. Fill the **Identity Provider Configuration** section. Your identity provider will provide you with all the information in this section. ![Configuration settings for an identity provider, including issuer URL, client ID, and secret.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LGK_OpenID Connect Identity Provider Configuration_Jun26.png) 1. **Issuer URL**: The globally unique URL that identifies the identity provider in the OpenID Connect exchange. 2. **Client ID**: A unique ID the identity provider assigns to your application so it knows which app is requesting authentication. 3. **Client Secret**: A password shared between your application and the identity provider to verify that login requests are genuinely coming from your application. 3. Click the grey ![toggle icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Toggle off icon.png) toggle to turn on **Just-in-Time provisioning** (JIT), which automatically creates accounts for new users that authenticate using SSO. ![Settings for Just-in-Time Provisioning and Default JIT role selection for users.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_JIT provisioning_Jun26.png) 1. **Default JIT Role**: Select which permission level you want to automatically provide users once their account is created through JIT. For a list of permission levels and their descriptions, please see [Permission Levels: Overview](/logikcull-for-public-records/docs/permission-levels-overview). > [!WARNING] > Important > > When JIT is off, new users won't automatically get an account in the application the first time they log in – someone will need to manually create it for them first. This is useful in larger organizations where identity provider access and app account setup are handled by different individuals / teams, or if it’s preferred that user roles are assigned manually. 4. Scroll to the top of the page and click the **Enable** button to turn on SSO. ### Disable SSO You can disable your identity provider’s SSO by clicking the **Disable** button.![OpenID Connect SSO is active; agency members must sign in through their provider.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Disable SSO_Jun26.png)