CollegeVine supports two kinds of SSO. The first (admin SSO) is for university administrators accessing the CollegeVine platform. The second (constituent SSO) is for users engaging with the agent about sensitive data. The article below provides an overview of each functionality, and how to set it up with your CollegeVine team.
Admin SSO
CollegeVine can support SSO with any IdP, to provide your users with a secure, auditable login experience. To set up SSO, let your CollegeVine team know, and you'll receive a link to a self-service ticket where you can upload your metadata, and which will contain CollegeVine's EntityID and Single Sign-On URL. For more details, check out this article!
Admin SSO login flow
When admin SSO is enabled for an institution, SEM users who visit platform.collegevine.com and click Log In are redirected to the institution's SSO provider to authenticate. Once credentials are verified, users are redirected back to platform.collegevine.com with access to the platform.
Even when SSO is enabled, users who are accessing the platform for the first time must still be verified as SEM users through the standard verification process. See the User verification by CollegeVine section below for details.
Note that constituent SSO (used for constituent-facing properties such as the agent) is a separate configuration that may also be enabled alongside admin SSO. Having admin SSO set up does not automatically apply to constituent-facing experiences.
Required attributes
CollegeVine requires an email_verified attribute to be returned as true. During the handshake, this attribute ensures that the email being passed to us has been verified by your IdP, so that your team can trust only valid users are accessing the CollegeVine platform.
User verification by CollegeVine
For an extra layer of security, after a user logs in using SSO for the first time, they will initially only have access to a generic landing page within the CollegeVine platform. Our operations team will confirm the user is a member of the team working on the CollegeVine project, and then assign them to your school instance, where they will be able to access your agents.
If you would like user sessions on the CollegeVine platform to time out after a certain amount of time (24 hours, for example), your team can also configure that for you. If no custom timeout is set, the default is two weeks.
Constituent SSO
To ensure your agents share sensitive information only with the correct user, CollegeVine allows you to mark data properties as sensitive. When the agent tries to retrieve one of these properties, it will be blocked from doing so until the user has authenticated using their institution credentials.
Configuration steps
Configuration starts with a self-service ticket. Note that even if you have admin SSO set up, you will still need a separate ticket, as constituent authentication is housed in a different tenant in CollegeVine's IdP
After completing the ticket, inform your CollegeVine team which properties you would like to mark as sensitive. Fields that our partners commonly mark sensitive typically involve financial information, but any field can be selected!
Note: If you would prefer not to test with real data, we can set up a dummy field for you
CollegeVine will provide you with the agent's email address and/or phone number so that you can test by asking the agent a question related to the sensitive field(s)
When the agent receives the question, it will tell you that you must authenticate before it can answer. You will receive an authentication link, which will take you to your institution's SSO portal
Once you have authenticated, the agent will respond to your question
Like for admin SSO, your CollegeVine team can set a custom timeout on how long users will be authenticated for. During this authentication window, the agent will not trigger SSO before responding to questions about sensitive data
Sign-in during phone calls
Your phone agent can ask callers to sign in before it shares sensitive properties. To turn this on, open the agent's phone settings and enable Sign in for locked information. Then choose how callers sign in:
University SSO: the link opens your institution's SSO sign-in page. Use this for current students and staff who have a university login.
Plain link: tapping the link signs the caller in directly, with no SSO page. Use this for prospects and admitted students who don't have a university login yet.
When a caller asks about a sensitive property, the agent texts them a sign-in link. If the constituent record also has an email address and the text doesn't work, the agent sends the link by email instead. Once the caller signs in, the agent answers on the same call.
💡 Before you turn on phone sign-in, check your agent's prompt for instructions that tell it not to share sensitive or personal information (for example, "you can't look up personal records" or "a staff member will follow up with sensitive details"). Remove them, since they conflict with the sign-in instructions the setting adds to the prompt automatically. You don't need to add any sign-in instructions yourself.
FAQs
Q: How does the agent know which constituent should be authenticating?
A: The agent matches the inbound communication channel (email address or phone number) to a constituent record that your team has uploaded. Following the handshake, the agent will match the email received from your IdP to the email contained in that constituent record.
Q: Can all users interacting with the agent authenticate using SSO?
A: SSO requires an institutional email, since the user must have a record in your IdP. On phone calls, you can use a plain sign-in link instead. It's sent by text or email to the contact details on the constituent record, so prospects and admitted students without a university login can still sign in.
Q: Do you support other methods of authentication for users (MFA code, security questions, etc.)?
A: On phone calls, you can use a plain sign-in link instead of SSO. MFA codes and security questions aren't supported.
Q: Do you support sign-in during phone calls?
A: Yes. See Sign-in during phone calls above. Callers are matched by phone number, so a constituent with only an email address on file can't sign in by phone.
Q: Can students sign in partway through a web chat?
A: Yes. Set your web chat channel's sign-in to Optional. Students start chatting anonymously and can sign in when they need their own records. Their earlier chat links to their constituent record and shows on their timeline. See Require authentication in your webchat for setup.