Signing in with a corporate account
If your company uses a corporate directory or a single sign-on service, you can enter DataForge with that account from the usual sign-in page, without a separate DataForge password.
How the sign-in page behaves
While no corporate provider is enabled in DataForge, the sign-in page stays as before: the address and the password on one screen. As soon as at least one provider is enabled, signing in is split into steps.
- On the first step, specify your address and click Sign in
- The system finds the account the address belongs to and the enabled providers of that account's company
- If providers are found, the address field is locked and labelled User, and the Identity provider field appears, listing each provider as its name and method: LDAP / AD, SAML / SSO or OAuth2 / OIDC
- If the address belongs to no account or the company has no enabled providers, this step is skipped and the DataForge password is requested, together with the Forgot password? link
A provider is offered only to the users of its own company. An unregistered address and the address of a company without providers lead to the same password step, so the page does not reveal which of the two it was.
Setting up the providers themselves is an administrator task and is described on the Identity providers page of the Integrations section.
Remembered addresses
DataForge remembers in this browser the addresses that have signed in successfully, whichever way the sign-in was made. A failed attempt never adds an address. When identity providers are enabled, the first step offers these addresses in a dropdown instead of an empty Email field:
- The address used most recently is already selected. To sign in as someone else on the list, pick their address from the dropdown, which shows five addresses at a time and scrolls for the rest
- To remove an address from the list, click the delete icon next to it in the dropdown. The icon's tooltip reads Delete from the list. If you remove the selected address, the most recent of the remaining ones is selected instead
- To sign in with an address that is not on the list, click Another user? under the field. The dropdown is replaced with an empty Email field
When nothing has been remembered in this browser yet, or every address has been removed, the first step shows the empty Email field.
Signing in with a directory account
This is the LDAP / AD method: the password is entered in DataForge and checked directly against the corporate directory.
- Specify your address and click Sign in
- Check that the right provider is selected in the Identity provider field. The address field is now labelled User and can no longer be edited
- Enter your corporate directory password in the LDAP/AD password field
- Click Sign in with SSO
After a successful check you land on the project list, exactly as after a built-in sign-in. If the password is rejected, the page stays on this step with the same provider selected, so you can enter the password again.
Signing in at your company sign-in page
This is how the SAML / SSO and OAuth2 / OIDC methods work: the password is never entered in DataForge, you authenticate on your company's own page.
- Specify your address and click Sign in
- Select the provider in the Identity provider field. No password is requested here
- Click Sign in with SSO. The browser is handed over to your company's sign-in page
- Sign in there. The browser returns to DataForge, a loading indicator is shown while the sign-in is completed, and then the session starts
The return leg is time-limited: the one-time code the browser brings back is valid for one minute. If the tab stays on the provider's page longer than that, the attempt has to be repeated and the message "The sign-in attempt expired — please try again" appears. If the return itself fails, the message is "Sign-in through the identity provider failed. Please try again".
When your company has several providers
All the enabled providers of your company are offered in the Identity provider list. The provider the administrator marked as the default comes first, the others follow by their order and name.
- Choose the provider your account actually belongs to. If your company uses two directories, signing in with the password of the wrong one is a failed attempt in that corporate directory and counts towards its lockout
- The provider you last signed in through successfully is preselected the next time you sign in, on any computer. Until you have signed in through a provider, the first one in the list is preselected, that is, the default provider when one is set
Signing in with a DataForge password instead
The Sign in with email button on the provider step opens the step with the DataForge password and the Forgot password? link. Your address stays locked in the User field there. To change the address or go back to the corporate providers, click Return to sign-in options: it returns to the first step. Both ways work at the same time — a corporate provider does not replace the built-in sign-in.
An account that has only ever signed in through a provider has no DataForge password, and an attempt to use one fails with the same message as a wrong password. Such an account can set its first password in the profile, in the Security block, without entering a current one.
If the sign-in does not succeed
| Message | What it means |
|---|---|
| "This account does not exist in DataForge. Contact your administrator" | The corporate account was verified, but there is no DataForge account with this address. Accounts are created only by invitation |
| "None of your directory groups grant access to DataForge" | The provider grants access by directory groups, and you belong to none of the listed ones |
| "This account is not allowed to sign in. Contact your administrator" | The account in the corporate directory is disabled, locked, expired, or not permitted to sign in |
| "Your password has expired. Change it in the corporate directory" | Change the password in the corporate directory and sign in again |
| "Authentication service unavailable. Please try again later" | The corporate directory did not answer. Try again later, and tell your administrator if it repeats |
| "The directory entry for this account has no email address" | The directory record does not contain the data DataForge reads from it. Only an administrator can complete it |
| "User is disabled. Contact the administrator to restore access" | The DataForge account was deactivated by an administrator |
| "Access denied for your IP address. Contact administrator for details" | The corporate account was verified, but your address is not allowed by the company IP filtering |
| "Incorrect email or password" | A wrong password, or another reason the system does not disclose on the sign-in page |
| "Too many attempts. Please try again later" | Too many sign-in attempts in a short time. Wait and repeat the attempt |
The reason for every attempt is written to the audit log even when the message on the screen is a general one, so an administrator can always look up what actually happened.
What is taken from the corporate account
The data of the corporate account is applied on every sign-in, not only on the first one:
- The first and last name are taken from the corporate account. If the provider sends no name at all, the address is shown instead, but only while the account has no name of its own — a name entered in DataForge is never overwritten
- The list of your groups in the corporate directory is refreshed
- If the administrator has configured rules that map directory groups to roles, your role is brought in line with them. When several of your groups match, the most privileged role wins, in the order Administrator, Developer, Analyst, Viewer. When no such rules are configured, the groups are only recorded and the role stays unchanged
- Signing in through a provider never creates an account: it must already exist in DataForge and belong to your company
- If you were invited but never filled in the activation form, the first successful corporate sign-in activates the account
Your corporate password is never stored in DataForge: with a directory provider it is only passed on for verification, and with the redirect methods it is not entered in DataForge at all. Everything you do after signing in works the same way regardless of how you signed in.