Corporate authentication with Static SSO

Static SSO delegates authentication to your Identity Provider while user accounts, roles and access scopes remain managed in Goodays.

It is the appropriate option when your main objective is to let employees use their corporate login without automating user administration. It is also the fastest SSO option to implement: once the SAML metadata has been exchanged, only a few configuration steps are required on the Goodays side.

How it works

The login can start from either side:

• From Goodays: the user enters their professional email address and Goodays redirects them to the IdP associated with that email domain.
• From your IdP: the user clicks a Goodays link or application tile in your corporate portal, intranet or IdP. The IdP initiates authentication directly toward Goodays, so the user does not need to visit Goodays first.

In both cases, the user authenticates with their usual company credentials. The IdP sends a successful SAML response, then Goodays matches the authenticated email address to an existing account and opens the session.

If no Goodays account matches the email address returned by the IdP, access is not granted. The account must exist before the user's first SSO login.

Account and access management

With Static SSO:

• Your IdP authenticates the user and maintains their corporate identity.
• Goodays maintains the corresponding user account, role and access scope.
• The email address is the common identifier between both systems.

The operational method used to create or update Goodays users is agreed with your Goodays representative. It may rely on administration or an established import process, depending on your organization.

Implementation

Define the population

We first identify the professional email domains and user populations that will use SSO. If several subsidiaries use different identity systems, Goodays confirms whether multiple IdP configurations are required.

Configure SAML

Goodays provides the project-specific Service Provider information. Your identity team creates the Goodays application in its SAML v2 IdP and provides the corresponding IdP metadata.

The professional email address returned by the IdP must exactly match the email address of the Goodays account.

Prepare representative users

Before validation, the relevant accounts are created in Goodays with their expected roles and scopes. A small set of users representing the intended populations is sufficient to validate the login journey.

Validate and activate

Goodays and your identity team verify corporate redirection, SAML authentication, account matching and the resulting access. Once both teams agree on the result, SSO is activated for the intended population.

Certificate ownership and future metadata updates should be assigned to a known identity-team contact so that configuration changes can be coordinated with Goodays.