Set up OIDC-based single sign-on on a memoQ TMS - Part 2 - for a memoQ administrator

1. Start logging in to the memoQ TMS using memoQweb or the memoQ desktop app.

   • In memoQweb, just open the sign-in page.
   • In the memoQ desktop app, click the Forget login link on the Dashboard), then click the check mark button next to the server name. Then, in the Log in to server window, choose the Log in with external identity provider option.
2. If there are two or more ID provider systems on the sign-in page, choose yours from the list.
3. Your ID provider’s login page opens. Log in with your company username and password (and do multi-factor authentication if needed).
4. Choose the No, this is my first time here option, and close memoQ or the browser.
5. Now, sign in to memoQweb with the admin user using their memoQ credentials.
6. On the left sidebar, click the Admin  icon.
7. On the Admin screen, click the Users button. The Users screen opens.
8. Click the newly created user, and at the bottom of the page, set its Account status to Active.
9. Click the Update user button.
10. In the Group membership section, add the user to the Administrators group.
11. Sign out of memoQweb, and log in to memoQ or memoQweb with your company username and password.

From now on, you can log in with your company credentials and enjoy the same privileges as the original admin user. Administrators have full power to create, modify, manage and delete server users, resources, and projects.

We recommend not to use the built-in admin user in your daily work. (Just change its password and store it at a safe location.) Also, it cannot be used with SSO. This is a safeguard for emergency situations when the memoQ TMS cannot connect to the ID provider service – you will still be able to access the server with the built-in admin user.

Notify the users who will need to log in to the memoQ TMS using SSO. They should:

1. Start logging in to the memoQ TMS using memoQweb or the memoQ desktop app.

   • In memoQweb, just open the sign-in page.
   • In the memoQ desktop app, click the Forget login link on the Dashboard), then click the check mark button next to the server name. Then, in the Log in to server window, choose the Log in with external identity provider option.
2. If there are two or more ID provider systems on the sign-in page, choose yours from the list.
3. Your ID provider’s login page opens. Log in with your company username and password (and do multi-factor authentication if needed).
4. Choose the No, this is my first time here option, and close memoQ or the browser.
5. Ask the memoQ administrator to approve your registration in memoQweb.

When a user connects to a memoQ TMS with their ID provider credentials for the first time, the Authentication Manager creates a new, pending user who is not a member of any group. Before they can log in and do anything on the server, an administrator needs to approve their registration, and add them to a user group (or – in special cases – set up their user permissions individually).

The Authentication Manager fills user details that are in the ID provider system (for example, full name or email address). But the OIDC protocol does not send group membership information, so the memoQ TMS cannot add newly created users to the corresponding groups. This is why an administrator needs to arrange users and groups on the memoQ TMS.

Sign in to memoQweb as an administrator, add the users to groups as needed, set up their access rights, and change their Account status to Active.

If you have users who will not be in your company ID provider system, you – as a memoQ administrator – can create memoQ users for them in the memoQ desktop app or in memoQweb.

Tell the newly created users to log in to the memoQ TMS. Send them the server address, their username, and their password.

When adding users from memoQweb’s user management page, you can set a temporary password that they need to change when they log in for the first time.