Article overview
Let your team sign in to WellSaid with the credentials they already use — no separate password to manage.
WellSaid supports Single Sign-On (SSO) for Enterprise accounts. This article covers how to set up SSO, the configuration values your technical contact will need, and how to troubleshoot sign-in issues.
Before you get started
- SSO is an Enterprise add-on. Contact your Account Executive or Customer Success Manager to add it to your contract.
- You'll need a technical contact (usually IT or another technical resource) to configure the connection with your identity provider.
Setting up SSO
- Identify your technical contact — usually IT or another technical resource.
- Connect them with the WellSaid technical contact — Support will make the introduction.
Your technical contact will send an SSO setup link. A test connection button appears at the end of setup.
- If the test succeeds, notify your WellSaid contact to enable SSO for your whole team.
- If it returns an error, schedule a 30-minute call with both technical contacts to troubleshoot.
SAML configuration values
Values your technical contact provides:
| Value | Example |
|---|---|
| Sign-in URL | https://samlp.example.com/login |
| Sign-out URL (if enabled) | https://samlp.example.com/logout |
| X.509 signing certificate | — |
Values WellSaid provides:
| Value | Details |
|---|---|
| Entity ID | urn:auth0:wellsaidlabs:XXX-saml |
| ACS URL | https://auth.wellsaidlabs.com/login/callback?connection=XXX-saml |
| SP initiated | true |
| SP certificate | https://auth.wellsaidlabs.com/pem |
| Attributes |
firstname, lastname, email — must be included in the SAML response |
XXXis replaced with the values assigned to your team.
Open ID Connect (OIDC)
Values your technical contact provides:
| Value | Example |
|---|---|
| Sign-in URL | https://samlp.example.com/login |
| Sign-out URL (if enabled) | https://samlp.example.com/logout |
| X.509 signing certificate | — |
Values WellSaid provides:
| Value | Details |
|---|---|
| Entity ID | urn:auth0:wellsaidlabs:XXX-saml |
| ACS URL | https://auth.wellsaidlabs.com/login/callback?connection=XXX-saml |
| SP initiated | true |
| SP certificate | https://auth.wellsaidlabs.com/pem |
| Attributes |
firstname, lastname, email — must be included in the SAML response |
XXXis replaced with the values assigned to your team.
Troubleshooting
If a team member gets an error signing in, confirm they're approved to access WellSaid through your SSO provider. For other issues, contact Support.
FAQs
Q: Will there be a service disruption while SSO is configured?
A: Minimal, if at all. SSO is configured asynchronously. Once the test connection succeeds, your SSO contact enables SSO and notifies your team with sign-in instructions.
Q: Is SSO included in my contract?
A: SSO is an add-on to your contract. To discuss adding this service, please contact your dedicated Account Executive, Customer Success Manager, or Support.
Q: What is the idle timeout for users?
A: 24 hours for idle timeout, 7 days for session timeout.
Q: What SAML bindings are supported?
A: Redirect is set up automatically; POST is also supported.
Q: Is the Assertion Consumer Service URL included in the SAML request?
A: Yes, via the AssertionConsumerServiceURL attribute.