Sign–in and security

How do users sign in?

In the Security section of the white-label settings, you decide how users of the instance log in. Authentication type has three options:

  • Local: users log in with their email address and a password stored on the platform. This is the default.
  • Remote: users enter their email address and password on the instance's login page, and your own service checks them.
  • SAML: users log in through your identity provider, with single sign-on.

With every option, a user has to exist on the platform before they can log in. Sign-in identifies them by their email address and creates no one. Create users in Account management, or let your own system create them through the REST API.

Guests who join a meeting do not log in, unless the meeting admits only logged-in users. See Who may enter a meeting?.

How do I set up a remote login?

SettingWhat it does
Login urlThe address of your service. The platform sends it the email address and password a user entered, and expects to hear whether they are valid.
Reset Password urlWhere the "forgot password" link on the login page takes users, so they reset their password with you rather than on the platform

How do I set up SAML single sign-on?

SettingWhat it does
Entry pointThe single sign-on address of your identity provider
IssuerThe name under which the instance identifies itself to your identity provider
Public remote certificateYour identity provider's signing certificate, so the platform can verify its responses
Authn contextThe authentication context the platform requests, if your identity provider expects a specific one

In your identity provider, register the instance with this address for the responses:

https://<host name of the instance>/api/v6/auth/saml/callback

The response must carry the user's email address, which is how the platform recognizes them.

Can users who are already logged in to your intranet skip the login?

Yes, with cookie SSO. If your own web application sets a cookie that the instance's host name can read, the platform can use it to log the user in.

SettingWhat it does
Cookie SSOSwitches cookie SSO on
Cookie nameThe name of your cookie
Cookie verification URLYour service that receives the cookie's value and answers whether it is valid and which email address it belongs to

The cookie must be readable by the instance, which in practice means that the instance runs on a subdomain of the domain that sets the cookie.

What other security settings are there?

SettingWhat it does
Allow two-factor authenticationUsers can protect their login with a code from an authenticator app
Allow two-factor authentication fallback to emailA user without their authenticator app can have the code sent by email. Convenient, but it makes the email account the second factor. On by default; turn it off where that matters.
Login asAdministrators of the instance can log in as one of its users, after confirming their own password and, if they use one, their second factor. Off by default. See The partner portal.
Use Captcha verificationProspects have to solve a captcha when they register a trial account themselves

Passwords and keys are never shown again once saved. The fields show a placeholder, and saving without changing it keeps the stored value.

We set some rules for you, such as the minimum password length and how long a session lasts. See Configured for you on request.

Not sure how to best implement your project?

Contact our team to discuss the details.