Login Methods

Enforce Sign In Methods and configure SAML SSO

Note: All settings related to security and authentication can be modified by an Admin only. Learn more about user roles in ClearFeed here.

Enforcing Sign In Options

Users from an organization can log in to ClearFeed via multiple methods: Google Sign-in, Microsoft Sign-in, or a login link (magic link).

By default, users are allowed to sign in via all options. Enforcing sign-in allows admins to limit the sign-in option to only Google or Microsoft login.

You can configure the sign-in settings by following the steps below:

1. Navigate to this page -> https://web.clearfeed.app/settings/security

2. Toggle on Google Authentication or Microsoft Authentication

3. This will log out all users who did not log in via the selected authentication method.

4. These users would then need to log in again using the enforced sign-in option.

SAML Authentication

ClearFeed provides the option to integrate Single Sign-On (SSO) using the Security Assertion Markup Language (SAML) protocol, allowing users to authenticate with their identity providers (IdPs) to access ClearFeed.

Note: This feature is currently enabled for users via ClearFeed. If you'd like to enable SAML authentication, please reach out to us at [email protected] or via Slack.

SAML SSO

Prerequisites

Before configuring SAML SSO in ClearFeed, ensure the following:

• Login and create an account in ClearFeed using any of the existing Authentication Methods (Google/Microsoft/Magic Link)

• Contact ClearFeed support via Slack or email at [email protected] to enable the SAML SSO feature for your ClearFeed account. This feature is not automatically available and requires activation by the support team.

• Ensure you have administrative access to both ClearFeed and your identity provider.

• If you are using multiple accounts in ClearFeed, ensure you are logged in to the Parent Account.

• You have the SAML identity provider setup screen and documentation open.

SAML can be configured by visiting this link and clicking on the configure button.

Create SAML Configuration

Identity Provider Entity ID

Obtain the Entity ID from your identity provider.

• This is a unique identifier that the SAML protocol uses to exchange data between the identity provider and ClearFeed.

SSO URL

Provide the SAML SSO URL from your identity provider.

• This URL is where SAML authentication requests are sent and must be a valid URL.

X.509 Certificates

Supply one or more X.509 certificates provided by your identity provider.

• These certificates must include the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers and are used for validating SAML responses.

Company ID

Unique identifier for your company within ClearFeed.

• It is necessary for users to log in via SAML SSO.

• Note: This ID cannot be changed from the app once set up. Please contact ClearFeed support for help in getting it changed.

Additional Information Required by your IdP

• Audience/Service Provider Entity ID: This is a predefined value shown on the screen, which must be entered on your identity provider's configuration page.

• Callback URL: The Assertion Consumer Service (ACS) URL is also predefined, and provided in the SAML configuration modal. This URL is where the SAML response is sent after authentication. You'll need to register this URL with the SAML identity provider.

SAML Assertion

The SAML Assertion from your identity provider must include the following for successful authentication:

<saml:Subject> and <saml:NameID> elements must be present, and the<NameID> element must contain the user's email in the following format:

<Subject>
  <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
  [email protected]
  </NameID>
</Subject>

SAML authentication will not function without the presence of the above elements in the SAML Assertion.

User Attributes

ClearFeed also searches for the following attributes in the SAML assertion payload to enhance the user experience within the ClearFeed Web App. While these attributes are not mandatory for authentication, having them present can improve usability:

• fullName, name, displayName for the user's name.

• photoURL, avatar, picture for the user's avatar.

User Login Flow

Currently, we don't support the Identity Provider initiated flow, which means that every time the user wants to log in to ClearFeed via SAML SSO, the user will have to first navigate to https://web.clearfeed.app/login and click on Continue with SAML SSO

• Once SAML SSO is enforced, alternative authentication methods (such as Google, Microsoft, or Magic Link) cannot be used to log in to ClearFeed for regular users. This effectively enforces SSO for all users of your account.

• Administrators of the parent account can still log in using the alternative authentication methods. This ensures they do not get locked out in the event of any issues with the SAML configuration.

• Provisioning & deprovisioning

  • Clearfeed does not currently support SCIM for automated user provisioning, deprovisioning, or role mapping.

  • Clearfeed does not currently expose APIs for automating user creation, deactivation, or role mapping.

  • Anyone logging into the Clearfeed web app must have a valid Slack user in the connected workspace. If a user is removed from Slack, they will also lose access to the Clearfeed web app (in addition to not being able to log in via SAML).

Note: It is essential to consult your identity provider's documentation to obtain the correct values for the entity ID, SSO URL, and X.509 certificates. Additionally, regularly check for any updates or rotation of certificates to maintain SAML SSO functionality.

Note: It is essential to consult your identity provider's documentation to obtain the correct values for the entity ID, SSO URL, and X.509 certificates. Additionally, regularly check for any updates or rotation of certificates to maintain SAML SSO functionality.

Walkthrough: Setup SSO with Okta

Watch this short video to understand how to setup SSO with Okta.

If you cannot open the video below, access it here.

By default, IDP-initiated SAML login is not supported in Clearfeed. However, if you're using Okta, you can simulate an IDP-initiated flow using the steps below. This allows users to click on the Clearfeed application from the Okta dashboard and log in directly.

🔧 Setup Steps:

1. Go to your existing Clearfeed SAML app in Okta.

2. In the settings, enable the option: &#xNAN;“Do not display application icon to users” (This hides the original app to avoid confusion.)

3. Navigate to the Okta App Integration Catalog, search for “Bookmark App”, and click Add Integration.

4. On the Add Integration screen:

   • Set the URL to: https://web.clearfeed.app/login?saml_company_id=<Your Company ID>

   • You can find your company ID at: https://web.clearfeed.app/settings/security > SAML Authentication > Edit Configuration

5. Assign the new Bookmark App to the relevant users or groups in Okta.

Once this is set up, users will see the new Clearfeed application on their Okta dashboard. Clicking it will log them in directly to the Clearfeed web app via SAML.

• If the user is already logged in, they will be redirected straight to their Clearfeed Dashboard.

FAQs

1. If I have multiple ClearFeed accounts, does enforcing sign-in work for all accounts? Answer: No, enforcing sign-in is an individual account-level setting. If you have multiple accounts, users can still log in to other accounts using any of the login methods.

2. What happens if a user tries to log in via a method other than the enforced one? Answer: Users are shown an error message if they try to log in via another method. E.g. If an account has Google Sign-in enforced - and if a user tries to log in via the magic link. Upon clicking on the generated sign-in link in their email - they would see an error as shown below:

   
3. What if I accidentally used the wrong email (e.g., personal Gmail) during Google login and now can't change it? Answer: If you get stuck in the login flow because you previously used an incorrect email address (such as a personal Gmail instead of your company email), contact ClearFeed support.

4. I'm stuck on a spinning logo/login loop and can't reach the app, what should I try? Answer: If the login page keeps loading forever or you get stuck in a loop after choosing a sign-in method:

   • First, confirm you are using an allowed sign-in method for your account (e.g., if Google authentication is enforced, only "Continue with Google" will work; magic link or other methods will fail).

   • Do a hard refresh of the login page (e.g., Shift + Reload on Chrome) to clear any stale session state.

   • Try an Incognito/Private window or a different browser (e.g., Safari/Edge) to rule out cached sessions.

   • Temporarily disable browser extensions, especially password managers or autofill tools (e.g., 1Password, LastPass), which can sometimes interfere with the ClearFeed login flow.

   • Avoid rapidly switching between different login methods in the same browser session; stick to the enforced/primary method. If the issue persists after these steps, please contact ClearFeed support and share your browser, OS, and the exact steps you followed.