Single Sign-On Introduction – Knowledge Base

Configuring SAML-Based Single Sign-On In CanIPhish

CanIPhish supports SP-initiated and IdP-initiated Single Sign-On (SSO) for accessing both the CanIPhish Cloud Platform and CanIPhish Learner Dashboard. The Cloud Platform and Learner Dashboard each have their own SAML-based SSO configuration.

Onboarding Guides

A variety of different SSO providers and solutions are available. To assist with the setup, CanIPhish has developed onboarding guidance for major providers:

CanIPhish Cloud Platform

CanIPhish Learner Dashboard

Is your SSO provider missing from the above list? Let us know!

Note: Support for IdP-initiated SSO was released on July 13, 2025. If you setup SSO prior to this date and would like to use IdP-initiated SSO, please deactivate and then reactivate your respective SSO configurations within your CanIPhish tenant. As part of the reactivation process, both SP-initiated and IdP-initiated SSO will be included. If you run into any issues, please contact the CanIPhish Support Team.

Frequently Asked Questions:

What is the CanIPhish Cloud Platform?

This is the platform that administrators use to create and manage phishing or training campaigns.
Accessible at: https://caniphish.com/Auth/Login

What is the CanIPhish Learner Dashboard?

This is the dashboard that learners use to complete any assigned training.
Accessible at: https://learn.caniphish.com/Platform/Login

Is single sign-on compatible with platform white-labelling?

Yes! If white-labelling has been set up, CanIPhish will seamlessly alter the single sign-on and redirect URLs so that there is no reference to CanIPhish and that the login redirection goes to the white-labelled domain. If white-labelling was set up after single sign-on was set up, please follow the steps below:

Step 1. Deactivate the existing single sign-on deployment(s) within CanIPhish (i.e. if both Learner and Platform SSO are activated, disable both).

Step 2. Refresh the webpage (this will force the new configuration to be displayed on-screen).

Step 3. In some cases, the Single Sign-On URL will slightly change. If it has, please proceed to Step 4. If it hasn't changed, jump straight to Step 5.

Step 4. Go into your respective Identity Provider and update the SSO configuration(s) to use the updated SSO URL(s).

Step 5. Reactivate SSO within CanIPhish, and you're all good to go! Single Sign-On will now be fully white-labelled.

Can some users sign in without SSO?

Yes. Once Platform SSO is active, platform users must sign in with SSO, except those on the Direct Login Allowlist, who sign in with their email address and password instead. Use the allowlist for people who aren't in your identity provider, such as an external consultant, and keep at least one "break-glass" admin on it so a problem with your SSO configuration can't lock everyone out of your tenant.

To add someone, go to Platform Settings > Authentication Settings > Platform Single Sign-On, enter their email address under 5. Direct Login Allowlist (Optional) (one address per line, or separated by commas with no spaces, all in lower case), and click Update Configuration. They must also be a platform user in User Management. For how to send them a registration link, see Managing Platform Users and Account Ownership.

Users who aren't on the allowlist and try to sign in with a password see: "It appears that the administrator of your tenant has enabled Single Sign-On (SSO). Please log in using SSO instead of using direct authentication."

The Learner Dashboard has its own setting. Under Learner Single Sign-On, 5. Direct Login Access (Using Access Token) controls whether employees can still sign in with the access token from their training emails (Allowed) or only with SSO (Prohibited).