Below is the high-level diagram for the Mobile SSO User Experience flow.

Open

Mobile SSO Qualifications

• Desktop SSO must be implemented.

  • Please see Implementing Single Sign-On (SSO) for Desktop for more information.

• Deem Mobile Application opens a secure and private In App Browser to initiate the SAML authentication flow.

• Both SP-Initiated and IdP-Initiated are supported.

• Mobile SSO uses the same Console Site SSO Configurations as Desktop SSO.
  There are two mobile-specific settings: Enable Mobile SSO and Mobile Company SSO End Point.

• The user account must exist and be active to login using Mobile SSO.
  Note: Mobile SSO does not include profile provisioning like Desktop SSO. 

• Etta for IOS supports Hybrid SSO (both username and password and SSO authentication).

• If the site is configured for Hybrid SSO (both Username/Password and SSO authentication), then the Deem Mobile Application will only support SSO authentication.
  Only users who have access to the customer's SSO Service will be able to sign in to the Deem Mobile Application.

Configuring Mobile SSO

Shared Desktop and Mobile Configuration

To configure Desktop and Mobile SSO together, two applications in your SSO Service will need to be configured: one for Desktop and one for Mobile.
The Mobile application will be configured with a Virtual Server Id so the SAML assertion will be processed for mobile.
The Virtual Server Id can be a string or URL but must be a different URL than the Desktop Application SAML Audience.
The following information is needed to configure your SSO Service.

• Desktop Application SAML Endpoint: https://go.deem.com/sp/ACS.saml2

• Desktop Application SAML Audience: https://go.deem.com

• Mobile Application SAML Endpoint: https://go.deem.com/sp/<Base64 Encoded Element of PingFederate Virtual Server Id>/ACS.saml2
  The element decoded is of the form {“vsid”:“<virtual-server-id>”}

• Mobile Application SAML Audience: <PingFederate Virtual Server Id>

• Relay State: If configuring for IdP-Initiated and multiple sites, a unique URL for your Deem domains that should be included with the SAML assertions. Your Deem Integrations Manager will provide these URLs.

The following information is required for Deem to complete the configuration.

• Issuer: The same unique identifier for Desktop SSO that represents you as a customer in the SAML assertion. Typically, this is a string or a URL.

• The X509 Certificate that is used to digitally sign your SAML assertions. This will be used by Deem to validate the SAML assertions you send.

• Mobile Company SSO Endpoint URL: If configuring for IdP-Initiated, this is the URL that the Deem Mobile Application will open to initiate the SAML authentication flow.

Separate Mobile Configuration

To configure Mobile SSO separately from Desktop SSO is simpler.
The following information is needed to configure your SSO Service. 
Note: This information is the same for Desktop SSO. (Please see Implementing Single Sign-On (SSO) for Desktop for more information.)

• Deem SAML Endpoint: https://go.deem.com/sp/ACS.saml2

• SAML Audience: https://go.deem.com

• Relay State: If configuring for IdP-Initiated and multiple sites, a unique URL for your Deem domains that should be included with the SAML assertions. Your Deem Integrations Manager will provide these URLs.

The following information is required for Deem to complete the configuration.

• Issuer: A unique identifier for mobile that represents you as a customer in the SAML assertion. Typically, this is a string or a URL.

• The X509 Certificate that is used to digitally sign your SAML assertions. This will be used by Deem to validate the SAML assertions you send.

• Mobile Company SSO Endpoint URL: If configuring for IdP-Initiated, this is the URL that the Deem Mobile Application will open to initiate the SAML authentication flow.

Sample Mobile SAML Response and Assertion