If a workspace uses your company's identity provider, such as Microsoft Entra ID, Google Workspace, Okta or Keycloak, you sign in to that workspace with your company account instead of a ContentMate password. This article explains signing in, linking an existing account and what a sign-in through the provider opens. How admins set up SSO is described in Set Up Single Sign-On.
Signing in
There are two ways:
- From the sign-in page: Enter your company email address on the sign-in page and click Sign in with SSO. ContentMate recognises the workspace by the domain of the address and sends you to your identity provider.
- With the sign-in link: Your admins can give you a sign-in link or add it to your company's portal. It leads straight to the workspace's identity provider.
After signing in at the provider you return to ContentMate and land on the workspace's dashboard.
If a sign-in link comes from another site, ContentMate first shows the page Sign in through the identity provider. Only continue there if you started the sign-in yourself, for example from your company's portal.
The first time
What happens the first time depends on whether a ContentMate account with your address exists already:
| Situation | What happens |
|---|---|
| No account yet, the domain of your address is proven for the workspace | ContentMate creates your account and adds you to the workspace with the default role. You do not need a password for this. |
| An account with this address exists already | The sign-in is refused. Sign in once with your password and link the provider in your profile (see below). |
| No account yet, the domain is not proven | The sign-in is refused. Ask your admins to prove the domain or to invite you to the workspace. |
From then on your account is bound to your sign-in at the provider, that is, to the identifier the provider sends for you.
Linking an existing account
If you already have a ContentMate account, you link it to the identity provider yourself:
- Sign in with your password.
- Open Profile and the section Sign-in through providers. It lists the workspaces that use an identity provider.
- Click Link next to the workspace and sign in at the provider.
When you are back, the workspace shows Linked since with the date. From now on you can also sign in to this workspace through the provider. Unlink removes the link again; your account and your password stay.
Linking only starts from your own profile, so nobody can connect your account to another sign-in through a link from elsewhere. It is valid for two minutes; after that, start it again.
What a sign-in through the provider opens
A sign-in through the identity provider applies only to that provider's workspace. You do not see your other workspaces in this session; for them, sign in with your password.
Some things work only after signing in with your password:
- changing your password and name
- subscription and payments
- data export and deleting your account
- linking or unlinking a provider
If the provider created your account, it has no password at first. If you need one, set it with Forgot password? on the sign-in page.
If the workspace enforces SSO
If the owner enforces SSO, you reach this workspace only through the identity provider; in a session with your password it is not available. You keep reaching your other workspaces with your password.
Signing out and session length
A session ends 24 hours after its last use and at the latest 14 days after signing in. Signing out of ContentMate does not sign you out of the identity provider.
If another ContentMate account is signed in in the browser, the sign-in through the provider does not replace it. The sign-in page then offers Sign out; afterwards, start the sign-in again.
Error messages
| Message | Cause and solution |
|---|---|
| No identity provider signs in addresses of this domain. | No proven workspace exists for the domain of your address. Check the address or sign in with your password. |
| An account with this address exists already. Sign in with your password and link the provider in your profile. | Link your account as described above. |
| There is no account for this address yet, and its domain is not proven for the workspace. | Ask your admins to prove the domain or to invite you. |
| The identity provider has not confirmed this email address, so no account was created. | Your provider reports the address as unconfirmed. Your IT team needs to confirm it there. |
| This sign-in at the provider belongs to another account already. | Your sign-in at the provider is already linked to another ContentMate account. Unlink it there or contact your admins. |
| You are no longer a member of this workspace. | You were removed from the workspace. A sign-in through the provider does not give access back. |
| The owner's plan no longer includes single sign-on. | The workspace no longer has SSO in its plan. Sign in with your password. |
| Another account is signed in in this browser. Please sign it out first. | Click Sign out and start the sign-in again. |
| The identity provider's answer could not be verified. Please start the sign-in again. | The sign-in was interrupted or is too old. Start it again; if the error stays, contact your admins. |
| The link expired. Please start it again in your profile. | Complete the link within two minutes of clicking it in your profile. |
| This works only after signing in with your password, not through the identity provider. | Sign in with your password to change this setting. |