SAML SSO deep-link authentication
SAML SSO deep-link authentication or IdP-initiated SSO is an alternative to standard IdP authentication in which the company IdP sends a URL associated with an application to Medallia Experience Cloud (the SP), and the verified user is then redirected to that URL to run the application. This is useful for companies that use multiple Experience Cloud applications because the user chooses the application from a list provided by the IdP. (The IdP may present only those apps the user is permitted to use.)
When using SSO deep-link authentication:
A user application starts with the company IdP home page, which authorizes the user.
The authorized user identifies the application from a list provided by the IdP. Each Experience Cloud application has a unique Client URL that identifies it. This is provided to the IdP by the person who sets up the Experience Cloud instance.Tip: The Client URL can redirect to a dashboard or report in Medallia Web reporting by including the URI to the report. For example, a Client URL might look similar to this to access a dashboard:
The URL can also tell a mobile device to load the Medallia Mobile application, like this:
After the user chooses the application, the IdP provides a SAML assertion that includes the Client URL in the
relayStateparameter. The IdP then redirects the user to the SSO endpoint: the Experience Cloud SSO SP server.
The application sends the assertion to the SSO endpoint.
The Experience Cloud server acknowledges the authorization, and verifies the Client URL by comparing the URL to an allow-list of authorized URLs. And then redirects the user to the application identified by the URL.
relaystate parameter in the SAML authorization response. The parameter includes a Client URL that identifies the user application to the Medallia Experience Cloud servers. For information about this relayState, see https://en.wikipedia.org/wiki/SAML_2.0, and review the section titled "Redirect to IdP SSO Service".