Enterprise (Project Coordinator) Single Sign-On

MyDataHelps Designer can use external OpenId Connect identity providers (such as Microsoft’s Entra or Okta) to authenticate project coordinators, including study developers, researchers, and other project support staff.

Contact CareEvolution Support to initiate Single Sign-On (SSO) configuration.

Contents

Identity Provider Setup

During the initial setup process, the MyDataHelps Designer server is configured to use one or more identity providers. Each identity provider is identified with a unique ID.

The exact configuration will vary depending on your identity provider, but all will need to consider:

  • Redirect URL - Where the user will be taken after authenticating.
  • Client Security - How the connection is guarded against unauthorized client access.
  • Claims - What information the identity provider needs to provide to MyDataHelps Designer.

Redirect URL

When a coordinator initiates the SSO process, the identity provider will authenticate the user and redirect back to a MyDataHelps Designer sign-in URL with the authorization code. The sign-in redirect URL is custom to each integration and will be provided to you by CareEvolution Support so that you can configure it in your identity provider. If your identity provider configuration requires this value up front, you might have to use a temporary placeholder until you receive the final value from CareEvolution Support.

Client Security

Identity provider integration supports the following methods of client authentication for security:

In addition, MyDataHelps Designer supports PKCE to prevent CSRF and code injection attacks.

JWKS Endpoint

When utilizing client assertions, you’ll need the JSON Web Key Set (JWKS) containing the public keys for MyDataHelps Designer server. These can be found at https://designer.mydatahelps.org/identityserver/.well-known/jwks. You will configure this in your identity provider.

Claims and Scopes

MyDataHelps Designer will request the openid, profile, and email scopes, which directs the identity provider to supply the following claims in the OIDC ID token:

  • a unique, stable user identifier (e.g., username or GUID; email address is not suitable since it may change)
  • first name
  • last name
  • email address

Completing the Setup

Make note of the Client ID and the Metadata URL from your identity provider setup and provide this information to CareEvolution Support. As noted above, we prefer the use of client assertions, but if you are using client secret for this configuration then you will also need to securely communicate a client secret to CareEvolution Support. If the secret has an expiry, be sure to communicate that as well so that future rotation can be planned.

Once the setup is completed by CareEvolution Support, you will be provided with two URLs:

  • The sign-in redirect URL that will need to be configured in your identity provider’s OIDC parameters.
  • Your custom login URL for MyDataHelps Designer. Many identity providers have an access portal feature which lists available applications, and this URL can be used in the entry for MyDataHelps Designer. If you do not use an access portal, your SSO users will need to bookmark this URL since we do not list SSO integrations on the regular login page.

Managing the Workspace and Users

Enabling SSO adds a new way to log in, but it doesn’t automatically replace MyDataHelps Designer usernames/passwords. Access to workspaces and projects is still managed in MyDataHelps Designer, and existing username/password logins will continue to work until you choose to restrict them.

Account Types

Once SSO is enabled for your workspace, there are essentially two types of accounts:

  • MyDataHelps Users - Users who registered with a MyDataHelps username and password. They could be pre-existing accounts, or users who register with MyDataHelps even after SSO is enabled.
  • SSO Users - Users who have never registered with MyDataHelps directly, and have only logged in through SSO.

SSO users log in using your organization’s custom login URL. If you have an identity provider access portal, you can add the login URL there for easy reference. If an SSO user attempts to log in through the regular MyDataHelps Designer login screen, they will be rejected.

MyDataHelps users log in using the regular MyDataHelps Designer login screen. If they attempt to log in with SSO, the system behavior depends on your organization’s preferences. See Merging Existing Accounts for details.

Adding Users

SSO allows users to log in to MyDataHelps, but does not automatically grant them access to any workspaces or projects. You will still need to invite them to your workspace and assign them to teams to give them the appropriate permissions. See User & Permission Management for details.

Merging Existing Accounts

When a MyDataHelps user tries to use your custom SSO login URL with the same email as their MyDataHelps account, there are two possibilities, depending on your organization’s preferences:

  1. The login attempt is rejected. -or-
  2. The MyDataHelps and SSO users are merged, and will be treated as an SSO user from that point onward.

During the SSO setup process, CareEvolution Support will work with you to determine which of these options is appropriate for your organization.

Requiring SSO for All Users

It is possible to limit access to your workspace to SSO users only. To avoid disruptions, this option should only be enabled after:

  • All users in your workspace have successfully logged in using SSO.
  • Any existing MyDataHelps users have been merged into SSO users.
  • You do not have any outside collaborators (or anyone else not using SSO) using the workspace.

Contact CareEvolution Support to enable this option for your workspace.

Have questions about MyDataHelps? Contact us.

© 2026 CareEvolution®, LLC