...

ClinSpark supports integration with SAML 2 SSO providers. Support for this functionality is enabled per environment, as a system feature, which impacts all users of the system. The enabling or disabling of SSO functionality is controlled by superadmin users.

...

Configuration of SSO varies depending upon the provider. This section documents Our documentation covers how ClinSpark can be configured to work with the providers which to date we have successfully integrated with.

Other SAML providers should work as well, and this documentation will grow as we encounter customer requests for additional providers.

...

Note that this must be done for each ClinSpark instance:

• ClinSpark typically has 2 instances per environment (MAIN and TEST).

• Each instance has a different URL, requiring new configuration to be done by the Site’s IT team: sandbox test, sandbox main, val test, val main, prod test, prod main, ….The Site’s customers site IT team. This would include environments covering Sandbox Test/Main, VAL Test/Main, PROD Test/Main, etc.

• The customer site IT team may want to configure all TEST instances to a TEST SSO IdP, and PROD instances to a PROD SSO IdP, resulting in different IdP login & IdP Logout URL.

Typical Workflow

As mentioned above, IQVIA Support works together collaborates with the each Customer and the Site’s site IT team for the setup of SSO. Typically, the following happens;:

1. The Customer creates a Service Desk Ticket, per instance, per environment (!). Usually, this can be one of the sandbox environments (main Main or testTest), but might be production as well. IQVIA suggests to start with only one instance (e.g., sandbox testSandbox Test) to first verify all details and workflow before rolling out over other instances & environments.

   Please provide:

   • Which type of IdP your organisation organization works with. Most common are Microsoft’s ADFS and Azure AD (see separate pages below this help article).

   • Provide the base URL (https://instance.clinspark.com)

   • Once SSO is enabled, users which have ‘SSO Disabled’ set to ‘No’ in their user profile won’t be able to login until SSO is fully functional. Please indicate which user need to (temporarily) have ‘SSO Disabled’ set to ‘yes’. Usually, this is an admin that will work with IQVIA support for the duration of the SSO configuration.

2. IQVIA support will:

   • Provisionally enable SSO (to generate the SSO metadata). This will use temporary IdP login- and logout URL as well as temporary IdP certificate, since we need to get that from the Site’s IT team later on.

   • Disabled SSO for the desired users

   • Provide an URL to the metadata XML, which is necessary for the Site’s IT team to complete the SSO configuration. This URL usually has the form of https://instance.clinspark.com/sso/metadata

3. The Customer will then work with the Site’s IT team to have the application instance added to their IdP. Depending on the IdP (see separate pages below this help article) they should at least be able to provide IdP Login- and Logout URL as well as the IdP certificate, together with all necessary other IdP settings for IQVIA to complete the configuration.

4. IQVIA Support will update the configuration, and work with the Customer to test the configuration with a first test - user.

...