1641706 - SSO Request for CultureAmp, Mozilla's Engagement Survey Tool

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSO: Requests, task)

Description

[Steven]

We would like to put CultureAmp behind SSO before we launch our next Engagement Survey on June 22nd.

Comment 1

[Justin Dow [:jabba]]

I scheduled a meeting for Monday to go over this. I think we started setting it up in the past, so it's almost ready to go.

Comment 2

[Steven]

Awesome. Thank you for jumping so quickly on this and sending the invite. Have a great weekend, and I'll see ya then!

Comment 3

[Steven]

Attachment: Screen Shot 2020-06-11 at 5.17.17 PM.png

I noticed some new behavior on the CultureAmp sign-in page: there's a "SSO | Use your organization’s single sign on" button now.

Comment 4

[Steven]

Attachment: Screen Shot 2020-06-11 at 5.18.18 PM.png

When I go there and type in mozilla...

Comment 5

[Steven]

Attachment: Screen Shot 2020-06-11 at 5.18.55 PM.png

It changes the URL but doesn't sign me in.

Comment 6

[Justin Dow [:jabba]]

I looked at this and experience exactly what you described. It looks to me like it's a bug or misconfiguration on their end. It never even tries to redirect me over to auth0 or anything. Would it be possible to file a support request with Culture Amp to ask about this new behavior and if it's something they can enable for us? It's possible that although SSO is working via our sso.mozilla.com/cultureamp link, that they need to specifically enable it for their mozilla.cultureamp.com link.

Comment 7

[Steven]

Attachment: Screen Shot 2020-06-12 at 4.51.26 PM.png

It seems it's a bug on their side.

Email/password was taking precedence over SSO. Their engineers are going to take a look at it next week and follow up with me. In the meantime, I asked if they could remove the "Use your organization's single sign on" link, and they aren't able to, as it's not account specific.

At my request, they've disabled email/password, and now the issue is different. After entering the subdomain mozilla, I'm sent to the SSO error screen in the screenshot.

I'm still able to use sso.mozilla.com/cultureamp to log in.

Not sure how helpful it'll be, but they provided this link while troubleshooting to test the SSO configuration which also worked: https://mozilla.cultureamp.com/saml/mozilla

Any clue what could be happening here?

Comment 8

[Justin Dow [:jabba]]

Perfect. This is actually helpful. The callback URL that I had configured is https://mozilla.cultureamp.com/saml/callback/mozilla, however, I see that when I reproduce that Auth0 error message, that down at the bottom, it said the error was because that login screen is taking us to https://identity.cultureamp.com/saml/callback/mozilla instead. Which I'm guessing is a newer SAML endpoint that they are implementing. I was able to whitelist that URL alongside the one we already had, and now it appears that everything is working how it should!

Comment 9

[Steven]

Stellar. It's working for me now, too.

I've passed this along to their team to hopefully cut down on this kind of issue in the future. Thank you for jumping on this and saving the day!