Project Coordinator Single Sign-On

MyDataHelps Designer can use external OpenId Connect identity providers (such as Microsoft’s Entra or Okta) to authenticate project coordinators, including study developers, researchers, and other project support staff.

Contact CareEvolution Support to initiate Single Sign-On (SSO) configuration.

Contents

Identity Provider Setup

Identity Provider Setup

During the initial setup process, the MyDataHelps Designer server is configured to use one or more identity providers. Each identity provider is identified with a unique ID.

The exact configuration will vary depending on your identity provider, but all will need to consider:

Redirect URL - Where the user will be taken after authenticating.
Client Security - How the connection is guarded against unauthorized client access.
Claims - What information the identity provider needs to provide to MyDataHelps Designer.

Redirect URL

When a coordinator initiates the SSO process, the identity provider will authenticate the user and redirect back to a MyDataHelps Designer sign-in URL with the authorization code. The sign-in redirect URL is custom to each integration and will be provided to you by CareEvolution Support so that you can configure it in your identity provider.

Client Security

Identity provider integration supports the following methods of client authentication for security:

(Preferred) Client Assertion (public key)
Client Secret

In addition, MyDataHelps Designer supports PKCE to prevent CSRF and code injection attacks.

Tip
You must use one of the above forms of client authentication. The use of PKCE is optional but recommended.

JWKS Endpoint

When utilizing client assertions, you’ll need the JSON Web Key Set (JWKS) containing the public keys for MyDataHelps Designer server. These can be found at https://designer.mydatahelps.org/identityserver/.well-known/jwks. You will configure this in your identity provider.

Claims and Scopes

MyDataHelps Designer will request the openid, profile, and email scopes, which directs the identity provider to supply the following claims in the OIDC ID token:

a unique, stable user identifier (e.g., username or GUID; email address is not suitable since it may change)
first name
last name
email address

Completing the Setup

Make note of the Client ID and the Metadata URL from your identity provider setup and provide this information to CareEvolution Support. As noted above, we prefer the use of client assertions, but if you are using client secret for this configuration then you will also need to securely communicate a client secret to CareEvolution Support. If the secret has an expiry, be sure to communicate that as well so that future rotation can be planned.

Once the setup is completed by CareEvolution Support, you will be provided with a custom URL which initiates the SSO process. You will likely want to configure this in your identity provider’s portal for ease of access.

Workspace Access

Users who enter through the SSO process are not automatically granted access to any workspaces or projects. You will invite/add their email address to workspaces just as you would for someone who authenticated with a MyDataHelps Designer password. See User & Permission Management for more details.

Existing Accounts

If you have existing users on your team who have authenticated with username & password, CareEvolution can optionally configure the SSO integration to merge those accounts with the SSO accounts based on email address match and disable password authentication after the first SSO. When using this option it’s crucial to verify that email address is not user-chosen in your identity provider. Please discuss this with CareEvolution Support.