Case study · Identity and access
SSO across sites and learning platforms
Hiscox multisite single sign-on in 2019 and IFoA SAML integration in 2022, with continuing support for the IFoA’s connected systems.
- Hiscox · 2019
- Configured single sign-on for seamless login across multiple sites.
- IFoA · 2022
- Advised on and configured SAML SSO from one identity provider to five service providers, including two CMS platforms and Totara.
- Ongoing contribution
- Maintenance and support of SSO functionality across all connected IFoA systems.
The requirement
Users needed a connected login experience across separately managed websites and applications. Each destination also needed to retain its own account and access rules.
Hiscox: multisite login in 2019
I set up single sign-on for Hiscox to allow seamless login across its multiple sites. The delivered capability was a shared sign-in experience across those sites.
IFoA: five connected service providers in 2022
I advised on and set up SAML single sign-on for the Institute and Faculty of Actuaries. The implementation allowed users to log in through one identity provider (IdP) to five connected service providers (SPs), including two content management systems and a Totara learning platform.
The delivered outcome was an identity-provider login route into the five connected services. My contribution covered technical advice and SSO configuration, followed by continuing maintenance and support across all the systems.
Ongoing maintenance and support
I continue to support the IFoA’s SSO functionality. My wider identity work includes authentication configuration, certificate maintenance and DNN authentication functionality, alongside integration with learning systems.
When investigating a login problem, I consider the identity provider, destination application and local account state together. Certificate changes, account mappings and platform changes all need attention over the life of an integration.
Identity and access are separate decisions
Establishing a person’s identity is one step. The destination must also match that identity to an account and apply its own permissions. I use that distinction when discussing requirements and investigating unexpected access behaviour.
Earlier public implementation
For Breast Cancer Care, I built a Drupal-Lithium SSO module covering login, registration and credential recovery, then returning users to their original Lithium page. The historical project links to the public Drupal.org module.