UE Advocacy supports self-service SSO setup that your IT team completes entirely inside your own IdP. No configuration is needed inside UE Advocacy itself.
To get started, request your SSO ticket(s) from your UE Advocacy CSM when you're ready to set up SSO.
What you'll receive
You will be issued up to two tickets depending on your setup:
Admin SSO ticket — always included. Controls SSO access to the UE Advocacy admin interface for your internal team.
Advocate / Hub SSO ticket — optional. Only needed if you are using the UE Advocacy Community Hub module. Controls SSO access to your advocate-facing hub.
Each ticket contains its own login URL and configuration values and must be set up separately in your IdP.
Note: SSO links generated from tickets expire after 5 days. Request them when your IT team is ready to complete setup.
Supported identity providers
UE Advocacy supports all major IdPs via OIDC or SAML 2.0, including Okta, Azure AD / Entra ID, Google Workspace, Auth0, Ping Identity, and Keycloak.
What's inside each ticket
Each ticket includes everything your IT team needs to complete setup:
Login URL (Admin or Hub)
Redirect URI / ACS URL
Required attribute mappings
UE Advocacy application identifiers
IdP-initiated URL (if you want to add a tile in Okta, Azure, Google, etc.)
Required attributes
email (must be unique; lowercase recommended)
sub (OIDC) or NameID (SAML)
given_name and family_name (optional)
Login flows
SP-initiated (default): User visits the Admin or Hub login URL, selects SSO, and is redirected to your IdP for authentication.
IdP-initiated (optional): You can add UE Advocacy as a tile in Okta, Azure, Google, Ping, etc. Each ticket includes the correct IdP-initiated URL for this.
Setup steps
Request your Admin SSO ticket from your CSM. Request the Hub SSO ticket as well if you are using the Community Hub.
Your IT team opens each ticket and completes setup inside your IdP.
Your IdP validates the configuration.
SSO goes live automatically once validation succeeds.
Test with a small group of users before rolling out broadly.
Troubleshooting
User can't log in after setup: Make sure the user or their group is assigned to the UE Advocacy app in your IdP.
Email domain mismatch error: The email domain must match the domain registered in your ticket.
IdP-initiated login not working: Double-check that the IdP-initiated URL from the ticket was copied exactly — this is the most common cause.
Questions? Contact your UE Advocacy CSM or email [email protected]