Skip to main content

Self-Service SSO: Enable Single Sign On using SAML for your account

Lori
  • Updated

You can establish SAML connections with your preferred identity provider (IdP) and use Checkr as a service provider (SP).

Checkr supports the standard SCIM APIs. To provision SCIM API for your account, contact Checkr.

Prerequisites

Checkr SSO has requirements for SAML connections, and more specific requirements for IdP-initiated and SP-initiated connections. Before initiating the connection, review your Checkr account and IdP setup to confirm that your setup is compatible with Checkr SSO.

For all SAML connections

  • Checkr doesn't provide and can't interpret SAML metadata.
  • Checkr uses HTTPS at the transport layer to secure network traffic you send to us. Checkr doesn't support additional assertion encryption.

For IdP-initiated connections

  • If you have multiple Checkr accounts, each account requires a separate SAML connection.
  • If you choose only IdP-initiated connections, Checkr can't prevent your users from changing their passwords on the Checkr platform. If you use SP-initiated connections with an email domain, Checkr can enforce these rules.
  • Your Checkr account allows users to have different email address domains.

For SP-initiated connections

  • If your organization has multiple Checkr accounts, you must first confirm that each of your email domains is attached to only one Checkr account. For example, users with an @bobsplumbingservice.com email address can be associated with only one of your Checkr accounts. Your users must log in to separate Checkr accounts with separate email addresses.
    • Checkr accounts allow multiple unique email domains to be associated with that account’s SSO connection Each unique domain can be associated with only one Checkr account.
    • Checkr identifies users by their email address, which must be unique. Each Checkr user can belong to only one Checkr account at a time.
  • Users must first authenticate through your IdP before they can access the Checkr Dashboard. Setting up SP-initiated SSO diables direct login to your account.

Select your identity provider to learn how to enable SSO for Checkr.

Configure IdP-initiated SSO

  1. In the Microsoft Azure Active Directory tenant nav tray, select Enterprise Applications. blobid0.png
  2. Select New Application.
  3. Select "Create your own application."
  4. On the right side of the screen, use the steps below:
    • Name your application.
    • Confirm that "Non-gallery" is selected.
    • Select Create.blobid1.png
  5. Select "Assign users and groups" and then "Add user/group" to add users or groups. Users you add must have a consistent attribute in Azure AD that matches their Checkr login email. The most common choices are usually user.mail or user.userprincipalname.
  6. On your application’s Overview page, select "Get started" in the "2. Set up single sign on" section.
  7. Select SAML.
  8. Use the information from the Single Sign On page in the Checkr Dashboard to update the information below in Azure:
    • Basic SAML Configuration section in Azure
      • Use the Single Sign On URL field in the Checkr Dashboard to update the Reply URL (Assertion Consumer Service URL) in Azure.
      • Use the Audience field in the Checkr Dashboard to update the Identifier (Entity ID) field in Azure.
    • Attributes & Claims section in Azure
      • As the attribute, enter "email" and use all lowercase.
      • Enter the user field your organization uses to store the email addresses for use as Checkr logins.blobid2.png
  9. In Azure, the "SAML Certificates" section populates.
  10. In Azure, select the Download link next to Certificate (Base64). In the Checkr Dashboard, select Choose File in the Signing Certificate section to upload the file you downloaded from Azure. The image below shows a Remove Current Cert button where the Choose File button will be. blobid3.png
  11. Use the Login URL field in Azure to update the Sign In URL field in Checkr.
  12. In the Checkr Dashboard, select Save.
  13. Log out of the Checkr Dashboard.
  14. Log out of Azure.

Test your configuration

To test your configuration, use the steps below in Azure:

  1. Confirm that you assigned your current user to the application.
  2. Confirm that your current user has a Checkr user name in the field assigned to the email attribute.
  3. Select the Test button.

Configure SP-initiated SSO

  1. Complete the steps for IdP-initiated SSO above.
  2. In the Checkr Dashboard, navigate to Account settings > Single Sign On.
  3. In the Email Domain field, enter an email domain. Only user names with this domain can log in.blobid4.png
  4. Select Save.

Test your configuration

Ask a user on your Checkr account to complete the steps below:

  1. Log out of the Checkr Dashboard.
  2. Open the Checkr login screen.
  3. Enter a user name that has your configured email domain. The password field should disappear. The screen should redirect to your IdP for authentication and then back to Checkr and log in.

If the test fails, complete the steps below and then repeat the test:

  1. Return to your Azure application’s SSO configuration.
  2. In the "Sign on URL" field, add dashboard.checkr.com/login.
  3. Select Save.
  4. Download the certificate again.
  5. In the Checkr Dashboard, upload the new certificate and save.

Configure IdP-initiated SSO

Sign in to a Google Workspace account that has super admin permissions, and use the steps below:

  1. Select Home, and then select Apps.
    GWimage8.png
  2. Select "Web and mobile apps."
    GWimage4.png
  3. Select "Add custom SAML app."
    GWimage3.png
  4. Enter the app name and an optional description and icon.
    GWimage5.png
  5. Select Continue.
  6. In the Checkr Dashboard, select Account settings > Single Sign On.
  7. Use the information from the "Configure SSO for SAML" page in Google Workspace to update the Single Sign On page in the Checkr Dashboard:
    1. Use the SSO URL field in Google Workspace to update the Sign In URL field in the Checkr Dashboard.
    2. In Google Workspace, select the download icon next to the certificate. 
    3. In the Checkr Dashboard, select Choose File in the Signing Certificate section to upload the file you downloaded from Google Workspace.
    4. In Google Workspace, select Continue.
      GWimage2.png
  8. Use the information from the Single Sign On page in the Checkr Dashboard to update the Service Provider Details page in Google Workspace.
    1. Use the Single Sign On URL field in the Checkr Dashboard to update the ACS URL field in Google Workspace.
    2. Use the Audience field in the Checkr Dashboard to update the Entity ID field in Google Workspace.
    3. In Google Workspace, set the name ID format to "email."
    4. In Google Workspace, select Continue.GWimage1.png
  9. In the "Attribute mapping" page of Google Workspace, select "Add another mapping."
    GWimage7.png

  10. Below "Google Directory attributes,", enter "Primary email."

  11. Below "App attributes,", enter "email."

  12. Select Add Mapping.
    GWimage9.png

  13. In Google Workspace, select Finish.

Test your configuration

To test your configuration, use the steps below in Google Workspace:

  1. Open the Admin console.
  2. Select Home, and then select Apps.
  3. Select "Web and mobile apps."
  4. Select your custom SAML app.
  5. At the top left, select "Test SAML login." Your app should open in a separate tab.

Configure SP-initiated SSO

  1. Complete the steps for IdP-initiated SSO above.
  2. In the Checkr Dashboard, select "Account settings" > Single Sign On.
  3. In the Email Domain field, enter an email domain. Only user names with this domain can log in.
  4. Select Save.

Test your configuration

Ask a user on your Checkr account to complete the steps below:

  1. Log out of the Checkr Dashboard.
  2. Open the Checkr login screen. 
  3. Enter a user name that has your configured email domain. The password field should disappear. The screen should redirect to your IdP for authentication and then back to Checkr and log in.

If the test fails, complete the steps below and then repeat the test:

    1. Return to your Google Workspace application’s SSO configuration.
    2. In the "Sign on URL" field, add dashboard.checkr.com/login. 
    3. Select Save. 
    4. Download the certificate again.
    5. In the Checkr Dashboard, upload the new certificate and save.

Configure IdP-initiated SSO

    1. In Okta, select the Applications tab and select Create App Integration.blobid5.png
    2. Select SAML 2.0 as the login method.
    3. In General Settings, configure basic visibility settings for your app in Okta. When you finish, select Next.
    4. In a new browser tab, log in to the Checkr Dashboard as an admin user and select Account settings > Single Sign On.
    5. Use the information from the Checkr Dashboard to update the fields below in Okta:
      • Single sign on URL
      • Audience URI (SP Entity ID)

        blobid6.png
    6. In Okta, select options for the items below and then select Next:
        • Name ID format
        • Application username
        • Attribute Statements (optional)
    7. In Okta, answer questions on the Feedback page, and select Finish. The "How to Configure SAML 2.0 for {appname} Application" page should open. If the page doesn't open, select "View SAML setup instructions."
    8. Use the information from Okta to update the Sign In URL field in the Checkr Dashboard.blobid7.png
    9. In Okta, select "Download certificate."
    10. In the Checkr Dashboard, select Choose File in the Signing Certificate section to upload the file you downloaded from Okta.
    11. In the Checkr Dashboard, select Create.

Test your configuration

Ask a user on your Checkr account to complete the steps below:

  1. Log out of the Checkr Dashboard.
  2. Log in to Okta and select the Checkr tile.

If the user can't log in, confirm that "email" is all lowercase in the Name field of the Email Attributes section. If you make changes to your configuration, use the steps below:

  1. In Okta, select "Download certificate."
  2. In the Checkr Dashboard, select Choose File in the Signing Certificate section to upload the file you downloaded from Okta.
  3. In the Checkr Dashboard, select Create.

Configure SP-initiated SSO

  1. Complete the steps for IdP-initiated SSO above.
  2. In the Checkr Dashboard, select Account settings > Single Sign On.
  3. In the Email Domain field, enter an email domain. Only user names with this domain can log in.blobid8.png
  4. Select Save.

Test your configuration

Ask a user on your Checkr account to complete the steps below:

  1. Log out of the Checkr Dashboard.
  2. Open the Checkr login screen.
  3. Navigate to dashboard.checkr.com, and enter a user email with your configured email domain. The password field should disappear. The screen should redirect to your IdP for authentication and then back to Checkr and log in.

Related articles

Popular Articles

FAQs about Checkr invoices

Customer Manage your account Payment and billing

FAQs about Checkr packages

Customer Available searches and verifications Checkr packages

How do I check the status of my background check?

Candidate My background check

What does the status of my report mean, and what are my next steps?

Candidate My background check

How do I submit a document to Checkr?

Candidate My background check

Something on my background check report is wrong. What should I do?

Candidate Dispute my report

Suspended and delayed background checks

Customer Review reports

Report statuses

Customer Review reports

User permissions

Customer Manage your account