Single Sign-On for CommCare HQ
- Gillian Javetski
- Former user (Deleted)
- Krinda Wernicke
- Matt Riley
Single sign-on (SSO) allows you to give your staff one account for all of the systems your organization uses. If you have a CommCare Enterprise account and have SSO set up for your organization, you can require your users to log in to CommCareHQ using their SSO credentials.
Supported Identity Providers
Additional SSO Settings
Multiple-View API Keys
Dimagi's default security stance regarding API keys is that users cannot view their keys again after creation. However, we recognize there are situations where this restriction disrupts workflows, and we have designed this feature to provide more flexibility and autonomy for users managing their own keys. Provided your organization understands the impact of allowing your users to view their keys multiple times, you can enable multiple-view API keys for users associated to your Identity Provider as follows:
From the Enterprise Dashboard, navigate to “Manage Single Sign-On”
“Edit” the desired Identity Provider
Scroll to the “API Key Management” section
Check “Always display full API keys to SSO users”
Log in to a user managed by the Identity Provider
Navigate to “My Account Settings”
Navigate to “API Keys
Click the “Copy Full Key” button next to the desired API key
Your API key should now be copied to the clipboard
Enforce API Key Expiration
Enforcing Key Expiration allows an identity provider to force all API Keys (including existing ones) to expire after a maximum amount of time. To enable this feature:
From the Enterprise Dashboard, navigate to “Manage Single Sign-On”
“Edit” the desired Identity Provider
Scroll to the “API Key Management” section
Check “Always require an expiration date for API keys” and specify an expiration window
Enforcing a new maximum expiration length will only update existing keys with expiration dates longer than the new setting. For example, an Identity Provider with a 60-day expiration length will update a key with a 90-day expiration but will leave a key with a 30-day expiration unmodified.