Common properties

Description

Informational message naming the company for which these settings apply.

Use Multiple IdPs (SAML)

Activates the SAML Identity providers screen screen and hides the IdP configuration properties on this screen.

Restriction: This option is enabled by default and only displayed onscreen for existing SAML configurations. Use the SAML Identity providers screen to create a new SAML SSO. For existing SAML configurations, do not turn this on without first receiving confirmation from Medallia, Inc.. Once this is turned on, it cannot be turned off.

Autologon Enabled

Turns on single sign-on. Most of the rest of the settings on this screen have no affect unless this is on (Session timeout is the exception). Once on, users can access the Medallia Experience Cloud using URLs that include "sso/" before the company ID. Users can also use the traditional username and password, whether or not this is on.

AutoLogon Type

The single sign-on protocol to use. Once of:

• OIDC — OIDC protocol. Configure the IdP(s) on the OIDC Identity providers screen.

• SAML — SAML 2.0 protocol. Configure the IdP(s) on the SAML Identity providers screen.

• Token — Deprecated; do not use.

Restriction: Other SSO protocols were previously supported, but they are are now deprecated or obsolete.

Display SSO login information

Displays a single sign-on (SSO) link on the web sign-on page. To use this feature:

• Autologon must be turned on for either OIDC or SAML single sign-on.

• This option must be turned on for the company instance.

Referrer Test (Deprecated)

Users must sign-in from a host listed in the Allowed Referrers list.

Note: Do not use this option when using SAML.

Allowed Referrers (Deprecated)

List of referral hosts to used by Referrer Test, one per line. Wildcards are valid, such as *.example.com.

SP Configuration (OIDC)

These properties configure Medallia Experience Cloud as a service provider (SP) when the AutoLogon Type is OIDC.

SP Configuration (Medallia side) (SAML)

These properties configure Medallia Experience Cloud as a service provider (SP) when the AutoLogon Type is SAML.

SP Issuer

The URL to access the company's SSO instance on the Experience Cloud web portal. The URL will include "sso/" before the company ID, like this:

https://INSTANCE.medallia.com/sso/COMPANY

                            
                            
                            

Note: The SP destination URL is the one the IdP uses when sending the assertion to Medallia. It is the same as the SP Issuer URL, except the target will include logonSubmit.do, like this

https://INSTANCE.medallia.com/sso/COMPANY/logonSubmit.do

Medallia Certificate

Identification information about the keys and certificate to be used in the SAML authentication flow. This property is only visible when Medallia Operations has configured the instance to encrypt requests to the IdP.

Depending on configuration, this key will be used as follows:

• If response-encryption is enabled, the key is used to decrypt the SAML response from the IdP.

• If request-signing is enabled, the key is used to sign the authN request to the IdP during the SP-initiated SAML flow.

The certificate information is included in the SP-metadata file provided to the IdP; it is never exposed in communications.

Generate SAML Metadata File

Generates an XML metadata file that contains the information the IdP needs to configure the connections with the Experience Cloud. The file contains the SP Issuer URL, and the certificate or key information the IdP needs, and some other metadata. The IdP uses this data to configure the connection.

Generate SAML Metadata File with secondary certificate

Same as the Generate SAML Metadata File option except this is only available when there is an secondary certificate configured for the instance. Use this option to share the configuration for the secondary certificate.

SP Certificate

Identifies the configured certificates to use for SAML communications.

Medallia fully manages certificate lifecycle.

• Medallia automatically generates the certificate.

• Medallia rotates certificates automatically.

• Medallia requires no renewals from the client.

• No certificate signing request or certificate files need to be managed.

• There is no downtime during certificate rotation.

When the primary certificate is due to expire, a new certificate will be created and installed on the instance as a "Secondary" certificate. After the certificate is installed:

1. On the Single Sign-On screen, use Generate SAML Metadata File with secondary certificate to create a configuration, and share that with the client administrator.

2. In coordination with the client administrator, change this setting from Primary to Secondary, and do it for this setting on both the Single Sign_on and SAML Identity Providers screens.

Eventually, when the old primary certificate expires and is removed, this setting will automatically be reset to Primary.

IdP Error URL

(optional) URL where the user will be redirected if there is a problem with the assertion from the IdP. This typically not set.

Original URL expiration (secs)

(optional) Count of seconds to remember the original URL the user used to connect to the Medallia application during SP-initiated sessions. A user might use a URL that goes to a specific report. If the sign-on process takes longer than this number of seconds, they will be directed to their default page instead, which is typically the Dashboard. Default is 600 seconds.

Allowed external redirect URLs

Approved URLs which the user may be redirected to. The IdP must send the URL in the SAML relaystate parameter. See SAML SSO deep-link authentication for information on using this. 

Use these URLs are for SSO deep-linking to these Medallia applications:

medallia://                  Medallia Mobile 
com.medallia.mobile://       Medallia Voices

Logout Redirect URL

(avoid) URL to redirect the user to when the signs-out of the Medallia application.

Warning: Do not use this property if the IdP supports more applications than Experience Cloud applications, because using this property can cause the IdP to invalidate the user on all other applications.

Session Expired Redirect URL

(avoid) URL to redirect the user to when the user's Experience Cloud session terminates.

Warning: Do not use this property if you are using SAML This option is not supported when multiple SAML Identity providers screen are defined.

Assertion values separator

Separator character to use when an assertion attribute can contain multiple values. When the assertion is processed, all values for an attribute are concatenated into a single string, with the values separated by this separator character.

Support encrypted assertions in response

Turn on decryption of the IdP assertion response. By default the response is assumed to be in plain text. This option is only available when Medallia Operations has configured the instance support encryption.

IDP Configuration (Customer Side) (SAML)

These properties describe how to connect to the IdP, and define the metadata necessary for communication between the IdP and the Medallia Experience Cloud.

IDP metadata file

Uploads the IdP-metadata file that describes the connection properties needed by to communicate with the IdP. Uploading the file automatically fills in the values for the required properties in this section.

IDP Issuer

Identity of the IdP to appear in the SAML response.

IDP Certificates

The company's IdP certificate (the public key + identifying information about the IdP signing certificate), that allows Experience Cloud to trust SAML responses from the IdP. To include multiple certificates, separate them with a semi-colon (;).

A configuration typically has only one certificate. However, when a certificate is about to expire this property allows the instance to have both the old and a new certificate for when the expiration happens. It is good practice to remove the old certificate once it has expired.

Medallia fully manages certificate lifecycle. The TLS certificates used for HTTPS endpoints also cover vanity domains for surveys, for information see RFC-8555. We only require clients to create a DNS CNAME record for the survey vanity domain, such as:

survey.customer.com CNAME survey-customer-com.vanity-domains.medallia.com
_acme-challenge.survey.customer.com CNAME _acme-challenge.survey.customer.vanity-domains.medallia.com

Once DNS entries are configured:

• Medallia automatically generates the certificate.

• Medallia rotates certificates automatically.

• Medallia requires no renewals from the client.

• No certificate signing request or certificate files need to be managed.

• There is no downtime during certificate rotation.

Warning: If your vanity domain is currently active and routing traffic through Medallia, contact the Support team prior to implementing any DNS changes. Current DNS configurations are integral to live traffic routing and automated certificate validation. Manual or uncoordinated modifications to these records may lead to service interruptions or failures in the automated certificate lifecycle.

Important: The company's IdP certificate is a public certificate and is not considered sensitive information. It is vitally important, however, that the certificate is handled carefully so that a third party cannot substitute a different public certificate in the Experience Cloud IdP configuration. When handling a company’s IdP certificate, ensure proper chain of custody of the certificate by following these guidelines:

• Ensure that you trust the source of the certificate. A direct e-mail or USB drive from a representative of the IdP team is preferred.

• Restrict the number of people who have access to the IdP certificate's storage location. Avoid (for example) leaving this certificate in a Google Drive to which multiple people have write access.

• Once the certificate has been uploaded to the Experience Cloud instance, have a user immediately attempt to sign in with an SSO SAML assertion signed by the key associated with the new IdP certificate. If the sign-in fails, troubleshoot immediately, and consider un-registering the new IdP certificate until the problem is resolved.

Inadvertently configuring Experience Cloud with a certificate from an untrusted source can allow a malicious third party to impersonate the company’s IdP, and therefore impersonate the company's users, which could in turn allow unauthorized access to the company's instance and its data.

IDP Certificates Info

Details about the IdP certificate(s). Of particular note is the Validity field that tells when the certificate will expire. Two weeks before this timestamp, Experience Cloud will issue a ticket to alert the administrators to prepare for a new certificate.

IDP Request Service URL

(Required) URL Experience Cloud uses to connect and send requests to the IdP.

Warning: Unless otherwise agreed to with the IdP, the SSO service URL should be to the service that provides SP-initiated authorizations. It is important that correct URL is provided because some IdPs have multiple URLs, and using the wrong one does not always fail in obvious ways. See Single sign-on (SSO) for more information. 

AuthnRequest uses POST binding

(Required for SP-initiated sessions) Turn on when the IdP requires HTTP POST bindings instead of REDIRECT for authentication requests. Most IdPs use REDIRECT.

Important: This option must be on for SP-Initiated sessions, and for Medallia Mobile. Medallia recommends using POST binding for web. 

Tip: If the IdP throws an HTTP 500 error when requesting an authentication, try turning this on.

Set AssertionConsumerServiceURL in the SSO Request

(Obsolete) Include the AssertionConsumerServiceURL in the SAML request. Experience Cloud no longer supports this option except in existing configurations.

Sign AuthRequest

Includes the SP-issuer signature in the request to the IdP when using POST binding. Most IdPs do not require this.

RPC Relay State

(Obsolete) Do not use this property.

Parameters (SAML)

These properties configure how to process the information in the assertion from the IdP. The three critical properties are:

• User AutoImport Spec — Whether or not to use the Auto Importer to process the sign-on.

• Find by username — Whether the assertion value is the User account's Username or the Company ID.

• Assertion Attribute name — Name of the assertion attribute that contains the identifying piece of information.

Most of the rest of the properties apply to obsolete or deprecated SSO protocols, and as such, can be ignored.

User AutoImport Spec

Auto Importer specification to process sign-on assertions. For detailed information see Create and verify SSO accounts with Auto Importer.

Find by username

Turn on when the identifying value in the assertion value is the User account's Username. Otherwise, when the value is the Company ID, leave this off.

Tip: Usernames must be unique in the company instance, but company account IDs do not have that requirement. As such, it is best practice to use the username whenever possible.

Error if account not found

(Avoid; not required for SAML) Turn on to present an error to the user when the User account does not already exist. Otherwise, create a new record based on the template.

Warning: Do not turn this off, even when there is no Auto Importer configured. Doing so may cause unexpected results.

Unit IDs Parameter

(Deprecated) Attribute or parameter identifying the account's Unit.

Unit Mapping Method

(Deprecated) Type of the Unit Mapping Field.

Unit Mapping Field

(Deprecated) Field to use for identifying the accounts Unit.

Template Company Account ID Parameter

(Deprecated) This is a legacy feature used to dynamically create and update users. It is best practice to use auto importer for dynamic account management instead and leave this field blank.

First Name Parameter

(Deprecated) Attribute or parameter containing the account's First name value.

Last Name Parameter

(Deprecated) Attribute or parameter containing the account's Last name value.

Include all units Parameter

(Obsolete) Do not use this property.

Assertion Attribute name

Name of the attribute in the SAML response that identifies the user account Username or Company Account ID. This property does not need to be set when using Auto Importer. See Single sign-on (SSO) for details about how to use this attribute in an Auto Importer specification.  

Error Messages

These properties are the error message to show users when single sign-on fails. Not all messages are available for all protocols.

Referrer Null Message

No referrer value could be retrieved from the request and the referrer check is enabled.

Referrer Not Permitted Message

The referrer is not allowed and the referrer check is enabled.

No Units Passed In Message

(Obsolete) No unit IDs are passed in, and they are expected.

No Units Available Message

(Obsolete) None of the units for this account are available.

No Such Template Message

(Obsolete) The template company account id cannot be found.

Session Expired Message

The user's session has expired.

Note: The user does not see this message for SP-initiated SSO because an expired session automatically redirects to the IdP for reauthentication.

Logout Message

Instructions to the user telling them what to do after they signed-out of Medallia Experience Cloud. Typically this tells the user to close the browser window.

Parameter mapping error message

A required parameter was not included in the request.

Account not found or inactive message

(Not applicable to SAML) The username does not have an account.

Fallback to account lookup failed message

Auto Importer failed because automatic updates are disabled for the user, and lookup was unable to find the account.

Session timeout in minutes (15 -30)

Count of minutes a session may remain inactive before Experience Cloud automatically signs the user out. Default is 30 minutes; range is 15 to 30 minutes inclusive. See Single sign-on (SSO) for details about session timeout behaviors. 

Max session duration in minutes (>30)

Count of minutes a session may be active before forcibly being signed out. Default is zero (0) or empty: no limit. The minimum duration is 30 minutes. When this property has a duration, all SSO users are automatically signed out after the specified number of minutes. They may immediately sign back in.

Suppress noisy SSO Event Tickets

Suppresses Event tickets caused by SSO failures. This option does not affect messages on the Single sign-on failed attempts screen: those messages always appear.

Turn this on when the system is receiving frequent SSO Event Tickets caused by bad requests from SSO users or Identity Providers, and the issues cannot be fixed by configuration changes.

These messages are suppressed by default:

• SAML authentication failed on the IDP side.

• SAML Assertion expired.

• SAML Assertion processing failed.

• Account not found - cannot create the token.

• No account was affected by the Auto Importer processing.

• There were issues while processing the SAML permission attributes. Please contact your administrator.

The list of messages to be suppressed can be configured by request to Medallia.