--- title: "SSO Configuration" slug: "sso-configuration" updated: 2026-09-25T17:46:40Z published: 2026-09-25T17:46:40Z canonical: "docs.revealdata.com/sso-configuration" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt > Use this file to discover all available pages before exploring further. # SSO Configuration Logikcull Public Records Requests supports single sign-on (SSO). You can turn SSO on or change your SSO settings in **Settings** > ![SSO icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LKK_SSO icon.png) **SSO**. ## Before you begin This workflow requires coordination with your IT department and your identity provider (IDP). **IT Department** Your IT department should let you know whether or not you use Active Directory Federation Services (AD FS) / Shibboleth / XML metadata or instead have a Discovery URL / Client ID / Secret. This will determine whether you’ll be setting up a **SAML** or **OpenID** protocall. **IDP** Your IDP should send you the appropriate URLs and IDs to fill into specific fields. You’ll also need to send your IDP one or more links from your Logikcull instance. ## Choose SSO protocol Choose between SAML or OpenID protocols depending on your IDP’s capabilities and available configuration artifacts. - **SAML** - Choose SAML if you use Active Directory Federation Services (AD FS), Shibboleth, or XML metadata. - **OpenID Connect** - Choose OpenID Connect if you have a Discovery URL or a Client ID / Secret. ## Configure and enable IDP Instructions vary slightly depending on the protocol you’re using. ### Enable SAML 1. Send the below two URLs to your service provider. They can be found under **Service provider Details** and copied using the ![copy icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Copy icon.png) copy icon. ![Service provider details including SP Metadata and ACS URLs for identity provider.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Service provider details_Jun26.png) - **SP Metadata URL** – A URL on your application that describes your SAML configuration to the identity provider, allowing the identity provider to set itself up automatically. - **Assertion Consumer Service (ACS) URL** – The URL on your application where the identity provider sends the user after a successful login, along with their authentication details. 2. Fill the **Identity Provider Configuration** section. Your identity provider should provide you with all the information in this section. ![Configuration settings for Identity Provider including URLs and certificate details.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPD_Identity provider configuration_Jun26(1).png) 1. **IdP Entity ID**: The globally unique name that identifies the identity provider in the SAML exchange. 2. **SSO URL**: The identity provider’s login page URL, where users are sent to authenticate. 3. **SLO URL**: Optional. The identity provider’s logout URL, used to sign users out across all connected applications simultaneously. > [!NOTE] > Note > > Not all identity providers support SLO; some applications are fine logging the user out locally. If you leave this blank, signing out will only log the user out of your *application*, not out of their identity provider or any other connected apps. 4. **X.509 Certificate**: A certificate from the identity provider that your application uses to verify that incoming login responses are legitimate and untampered. 5. **Name ID Format**: The format the identity provider uses to identify the logged-in user in the SAML assertion. 3. Click the grey ![toggle icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Toggle off icon.png) toggle to turn on **Just-in-Time provisioning** (JIT), which automatically creates accounts for new users that authenticate using SSO. ![Settings for Just-in-Time Provisioning and Default JIT role selection for users.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_JIT provisioning_Jun26.png) 1. **Default JIT Role**: Select which permission level you want to automatically provide users once their account is created through JIT. For a list of permission levels and their descriptions, please see [Permission Levels: Overview](/logikcull-for-public-records/docs/permission-levels-overview). > [!WARNING] > Important > > When JIT is off, new users won't automatically get an account in the application the first time they log in – someone will need to manually create it for them first. This is useful in larger organizations where identity provider access and app account setup are handled by different individuals / teams, or if it’s preferred that user roles are assigned manually. 4. Scroll to the top of the page and click the **Enable** button to turn on SSO. ![SAML Single Sign-On configuration instructions with an enable button for SAML.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Enable SSO_Jun28.png) ### ### Enable OpenID Connect 1. Send the below URL to your service provider. It can be found under **Redirect UI** and copied using the ![copy icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Copy icon.png) copy icon.![Redirect URI for callback registration with identity provider displayed in the image.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LGK_Redirect UI_Jun26.png) 1. **Redirect UI** – The URL on your application where the identity provider sends the user after a successful login, along with their authentication details. 2. Fill the **Identity Provider Configuration** section. Your identity provider will provide you with all the information in this section. ![Configuration settings for an identity provider, including issuer URL, client ID, and secret.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LGK_OpenID Connect Identity Provider Configuration_Jun26.png) 1. **Issuer URL**: The globally unique URL that identifies the identity provider in the OpenID Connect exchange. 2. **Client ID**: A unique ID the identity provider assigns to your application so it knows which app is requesting authentication. 3. **Client Secret**: A password shared between your application and the identity provider to verify that login requests are genuinely coming from your application. 3. Click the grey ![toggle icon](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Toggle off icon.png) toggle to turn on **Just-in-Time provisioning** (JIT), which automatically creates accounts for new users that authenticate using SSO. ![Settings for Just-in-Time Provisioning and Default JIT role selection for users.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_JIT provisioning_Jun26.png) 1. **Default JIT Role**: Select which permission level you want to automatically provide users once their account is created through JIT. For a list of permission levels and their descriptions, please see [Permission Levels: Overview](/logikcull-for-public-records/docs/permission-levels-overview). > [!WARNING] > Important > > When JIT is off, new users won't automatically get an account in the application the first time they log in – someone will need to manually create it for them first. This is useful in larger organizations where identity provider access and app account setup are handled by different individuals / teams, or if it’s preferred that user roles are assigned manually. 4. Scroll to the top of the page and click the **Enable** button to turn on SSO. ### Disable SSO You can disable your identity provider’s SSO by clicking the **Disable** button.![OpenID Connect SSO is active; agency members must sign in through their provider.](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/LPR_Disable SSO_Jun26.png)