How do I map email domains to an Identity Provider?

Email domain mapping tells SpeakUp which Identity Provider (IdP) a User should authenticate against, based on the domain of their email address. Mapping is what makes multi-Identity Provider SSO work, and what lets SSO coexist with password login.

When mapping is required:

• Only one Identity Provider configured: email domain mapping is optional.
• One Identity Provider with password login enabled: at least one email domain must be mapped.
• Two or more Identity Providers: every Identity Provider must have at least one email domain mapped.

Map an email domain: 

1. Click on the "Settings" icon in the top right corner.
2. Go to "System" and click on "Security". 
3. Open the Identity Provider you want to map an email domain to.
4. In the "Email domain mapping" section, enter the email domain (for example, acme.com).
5. To add more email domains for the same Identity Provider, click on "+ Add email domain" and repeat. You can map up to 20 domains per Identity Provider.

Edit a mapped email domain:

Editing a mapped email domain has the same impact as removing it: existing Users whose email matches the old domain are no longer routed to this Identity Provider after the change. Treat it as a remove-and-replace, not a quick text edit.

1. In the "Email domain mapping" section, click the edit icon next to the domain you want to change, update the value, and save.
2. A confirmation dialog appears showing how many Users are affected by this change. Choose what should happen to those Users:
   1. Disable all affected users: their access is revoked immediately.
   2. Keep users enabled: Users remain linked to the Identity Provider but their old domain is no longer mapped. They may encounter an error at next login unless they are covered another way.
3. If password login is enabled and you choose to keep Users enabled, you can optionally send an invitation email so affected Users can set up a password.
4. Click on "Confirm" to apply the change.

Remove a mapped email domain:

1. In the "Email domain mapping" section, click the remove icon next to the domain you want to remove.
2. A confirmation dialog appears showing how many Users are affected. Choose what should happen to those Users:
   1. Disable all affected users: their access is revoked immediately.
   2. Keep users enabled: Users remain linked to the Identity Provider but their domain is no longer mapped. They may encounter an error at next login unless they are covered another way.
3. If password login is enabled and you choose to keep Users enabled, you can optionally send an invitation email so affected Users can set up a password.
4. Click on "Confirm" to apply the change.

Email domain rules:

• Each domain must be unique across all Identity Providers in your organisation. If the domain is already mapped to another Identity Provider, an inline error is shown.
• Format requirements: at least one dot, no spaces, no @ symbol, no protocol prefix (such as https:// or www.), no path, and only letters, numbers, hyphens, and dots.
• Email domains are editable at any time, before or after enabling the Identity Provider.
• Email domains are only validated against enabled Identity Providers at login.