Configuring SAML 2.0 for Internal Candidates in Recruitment Marketing

Recruitment Marketing Public

Recruitment Marketing uses SAML 2.0 to implement Single Sign-On (SSO) for internal candidates/employees. The benefits of single sign-on include:

  • Candidates are always known, even without filling out a CTA.
  • You can lock content to internal candidates only.

Internal candidate SSO is achieved by way of an IdP initiated SSO flow. This means that the site login is initiated from within your organisation's Identity Provider (IdP) service. To facilitate this, the careers site is usually configured to display a link to the IdP initiated login page when the site is visited by an unauthenticated user. For more information refer to Preparing the site below.

For some information required to configure this functionality on your careers site, you will need to consult the IT team responsible for your Identity Provider (IdP) service.

Preparing the site

When an unauthenticated visitor attempts to access a careers site that has been configured to require SAML 2.0 single sign-on, they will be presented with the (403) Forbidden Page for that site.

Forbidden Page
To prepare your site:

  1. Update the content and styling of this page as appropriate. Usually, this will involve applying the standard template and layout which has been applied to the content on that site, and adding a "Welcome" message to the visitor.
  2. Add a link/button on the page that directs the visitor to the IdP initiated login page on your Identity Provider service.

An example of a styled "(403) Forbidden Page" is shown below:403 Example page

Note: if an external applicant is provided a direct apply link to a job ad by an internal applicant (who has access to the internal careers site), there is no mechanism to prevent this as this pertains to the career site's security rather than the direct apply link. 

Configuring Single Sign-On using SAML 2.0 for internal candidates

  1. Log into the Recruitment Marketing module.
  2. From the side menu, under Company click Settings.
  3. Under SAML click SAML 2.0 - Candidates.
  4. Either enter the iDP Metadata URL, and click Save, which will automatically parse the relevant information from the metadata file, or complete the following:
    • SP Entity ID - should be set to the full domain name of your new website (i.e., with no protocols
    • iDP SSO Target URL - consult your IT team
    • iDP Entity ID - consult your IT team
    • iDP Certificate - this is the public certificate from your enterprise identity provider, consult your IT team.
  5. Complete the following:
    • Suggested Clock drift - Recruitment Marketing and iDP systems do not share the same NTP server.
    • Mark as internal Candidates / Employees - select this checkbox
    • Allow application support access to protected content - check with your Implementation team before confirming.
  6. Click the Save button to keep the settings.

If using the IdP Metadata URL to configure the setting, the hosting domain of the metadata URL needs to be whitelisted within the Recruitment Marketing platform. Many common services such as Okta and Entra ID (formerly Azure AD) are already whitelisted. However, if you receive an error when clicking the Save button, please speak to your Customer Success Manager or Professional Services team member to have them arrange for your domain to be whitelisted.

In addition to the above setting within your Recruitment Marketing system, the IT team who are responsible for your organisation's Identity Provider (IdP) service, will need to configure a Relying Party Trust with the following information:

  • Assertion Consumer Service URL
  • SP Entity ID - should be set to the full domain name of your new website (i.e., with no protocols
  • The outgoing claim should include:
    • email
    • first_name
    • last_name

Restricting content to internal candidates only

  1. From the side menu, under Content click Web Pages.
  2. Click the name of the relevant web campaign.
  3. From the top right, click the Edit icon.
  4. Select the Restrict to SAML2 authenticated internal candidates checkbox.
  5. Click the Save button to keep the changes.



Article is closed for comments.