Gainsight Authentication

Overview

Gainsight provides the following authentication mechanisms:

• DB Authentication
• SAML 2.0 Authentication
• G Suite Authentication

By default, Gainsight provides DB Authentication to all the users added to the Users List. You can opt for additional authentication, that is SAML 2.0 or G Suite to increase the level of security.

The following are the fields and options displayed in the Authentication tab:

• Name: Displays name of the authentication type.
• Type: Displays type of the authentication.
• Status: Displays status of the authentication. Admins can Toggle on/off the authentication mechanisms through which the users can verify their identity and login to Gainsight.

Note:

• Gainsight gives precedence to SAML 2.0 or G Suite authentication over DB.
• For a given domain, you can set up either SAML 2.0 or G Suite. You can set up both SAML 2.0 and G Suite authentications only when the domains are different.

Prerequisites

• You must be a Super Admin to configure Users Authentication. To have Super Admin privileges, you must be added to the USERS LIST as a Super Admin in the User Management page.  
• Users who want to login to Gainsight through one of the authentication mechanisms should be added to the users list. For more information about how to add users to the users list, refer to the Gainsight User Management article.

Key Terms

• Super Admin: A Super Admin has access to all the Pages in Gainsight. Only Super admins can set up various authentication mechanisms.
• Authentication: Any of the processes by which an application confirms the truth of a user’s identity.
• DB Authentication: Act of confirming a user’s identity using their Username and Password.
• SAML 2.0 Authentication: Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. For example: IdPs can be SSO, Okta, Azure etc.
• Google Apps Authentication: Act of confirming a user’s identity using their Google Accounts.

Set up DB Authentication

Gainsight provides the DB Authentication mechanism out of the box to all the users added to the Users List. For more information on how to add users to the User List, refer to the Gainsight User Management article.

Note: Users can login using the DB method even if their domain in the username is different than what’s configured in SAML 2.0 or G Suite. For instance, if you are a Gainsight active user, your username is abc@xyz.com, your company has set up SAML 2.0 or G Suite authentication with its child company AAR.com, you will still be able to Gainsight Login using DB method.   

While adding a user to the users list in the User Management page, you have the ability to send a welcome email to the user saying that ‘Welcome to Gainsight! Your account has been created with the following credentials’, and requests to reset the password.

A user who receives a welcome email can login to Gainsight NXT using the access link provided in the email and change password for the first time. For more information, refer to the User Login Methods to Gainsight NXT article.

Set up SAML 2.0 Authentication

SAML 2.0 Authentication allows the users to login to Gainsight through Identity Providers (IdP), such as Okta, Azure, OneLogin, and Google. Once Gainsight is configured to authenticate using SAML 2.0, users who want to access Gainsight will no longer be prompted to enter a username or password. Instead, an exchange between Gainsight and the configured IdP occurs that grants Gainsight access to the users.

To configure SAML 2.0 Authentication:

1. Navigate to the Administration > User Management > Authentication page.
2. Click Add AUTHENTICATION and select SAML. The SAML Mechanism window appears.
   
   
    
3. Enter the following details:

4. Click SAVE.
   
   
    
5. Upload this metadata to your IdP to complete the setup of SAML connection.
6. Once the SAML authentication is configured, and when users attempt to sign into Gainsight through Direct Gainsight Login page, SAML redirects the user to the IdPs, such as Okta/SSO/Salesforce etc.
   Note: We recommend testing the SAML integration by logging out and logging in as a Super Admin using SAML.
7. (Optional, but recommended) Navigate to the Administration > User Management > Authentication page. Toggle OFF the DB Login to deactivate the DB Login, after which all users must log in using the central SAML authentication method.
   
   
   
   Note
   • If the user is already signed in to the SAML IdP (for example, the user is already signed in to Okta), the user is directly navigated to Gainsight. If not signed in, the user is redirected to the login page of IdP (for example, Okta’s login page).
   • Once the SAML Authentication is saved, you can download metadata by clicking Download Metadata.

Set up G Suite Authentication

G Suite Authentication enables the users to login to Gainsight NXT by entering their usernames, provided users have already logged-in to their Google accounts. Otherwise, users will be redirected to the login page of the Google account where the user enters the Google account credentials.

For example, if a user’s username is abc@AAR.com, and you have configured G Suite authentication for this particular user, then all of the users with AAR.com [domain name] are authenticated using G Suite. For other users whose domain name is different can login to Gainsight  NXT through DB method.

Note: You cannot set up G Suite authentication mechanism if your domain is already mapped with SAML 2.0 authentication.

To configure G Suite Authentication:

1. Navigate to the Administration > User Management > Authentication page.
2. Click Add Authentication and select Google Apps.
   
   
    
3. Enter the following details:

• Name: Enter the name of your choice for your identification. The name can only contain alphanumeric characters and “-”. It must be unique, begin and end with an alphanumeric character and can contain a maximum of 40 characters

• Google Apps domain: Enter your Google Apps domain name.

4. Click SAVE. Google Apps authentication mechanism is added to the list of authentication.
   
   
   
   Note: We recommend testing the G Suite authentication method by logging out and logging in as a Super Admin through G Suite.
5. (Optional, but recommended) Navigate to the Administration > User Management > Authentication page. Toggle OFF the DB Login to deactivate the DB Login, after which all users must log in using the G Suite authentication method.
   
   
    

Once the G Suite authentication is configured, users can login to Gainsight NXT just by entering your email address, provided you have already logged-in to your Google account, as your Company’s domain name is mapped with G Suite, otherwise, you will be redirected to the login page of your Google account and once you successfully login into your Google account, you will navigated to Gainsight. For more information, refer User Login Methods to Gainsight NXT.

Edit or Delete Authentication

You can perform the following actions by clicking three dots menu of the Authentication type in the Authentication page:

• Edit: Edit the authentication details.
• Delete: Deletes the authentication.

Note: You cannot edit or delete a System Authentication which is generated by default.

Additional Resources

For more information about user management, refer to the following articles:

• Gainsight User Management
• User License Management
• User Login Methods to Gainsight NXT
• User License Management FAQs