Configure SSO for Bluebeam Accounts | Okta Workforce Identity Cloud

Single sign-on (SSO) provides seamless access for your users by allowing them to access Bluebeam products using their IdP login credentials. This guide provides instructions for the IT Admin to configure SSO for their organization if they use Okta Workforce Identity Cloud as an identity provider (IdP). If you use Microsoft Entra ID as an IdP, see Configuring SSO for Bluebeam Accounts | Entra ID.

If you use an IdP other than Entra ID or Okta Workforce Identity Cloud, see Configuring SSO for Bluebeam Accounts | Generic OIDC for information about SSO configuration for unsupported but compatible IdPs.

Requirements

The ability to configure SSO is only available if your organization:

• Has purchased or converted a minimum of 10 seats to a Bluebeam subscription plan.
• Is not already configured to use SSO with Bluebeam products and services. If your organization already has SSO configured, contact us before continuing.
• Uses Microsoft Entra ID or Okta Workforce Identity Cloud as an identity provider (IdP).
  

If you meet these requirements and want to enable SSO for your organization, have the Org Admin perform the following steps to request access to configure SSO and SCIM:

1. In your web browser, type the Org Admin URL that corresponds with your region:

   • US app.bluebeam.com/org-admin
   • CA app.bluebeam.ca/org-admin/home
   • SE app.bluebeam.se/org-admin
   • DE app.bluebeam.de/org-admin
   • AUS app.bluebeam.com.au/org-admin

   • UK app.bluebeam.co.uk/org-admin

2. Under Accounts, select the account you want to manage.

3. Select Settings.

4. Next to SSO Configuration, select Request Access.

   If your organization doesn't meet the requirements for SSO configuration, the Request Access button isn't available and you can't proceed.

5. Provide the requested information.

After we receive and process your request, you can proceed to SSO configuration. If you selected I want to use SCIM, Bluebeam Support will contact you to let you know if you can proceed with SCIM activation or if further action is required.

Overview

This guide includes the configuration of SSO for access to Bluebeam products and services, as well as the information that needs to be exchanged between Bluebeam and your IdP.

SSO configuration should be performed by the IT administrator for your organization.

Claim and verify domains

To configure SSO, first claim and then verify the domain your organization owns and that you want to link with your Bluebeam account. To link more than one domain to your Bluebeam account, perform this procedure separately for each of those domains. You cannot configure SSO until you've claimed and verified at least one domain.

This procedure requires that you copy information from Org Admin and paste it into a new TXT record for your DNS server. You should be prepared to log in to the DNS server for each domain you want to claim to prepare for that step.

To claim and verify your domain, follow these steps:

1. In Org Admin, select Accounts, and then select the account you want to manage.
2. Select Settings.
3. Next to Domain Ownership, select Manage.
4. Select Claim Domain.
5. Enter the domain name you want to claim (e.g. company.com), and select Claim.
6. From the Verify Domain dialog, select Copy next to each field and paste the information to a new TXT record for your DNS server.
7. Wait at least five minutes, then select Check Verification.

Perform this procedure for each domain you want to claim and verify.

Configure SSO

SSO configuration requires that you perform a series of procedures in the Okta Admin Console before you complete configuration in Org Admin.

1. Create an Okta application for SSO

2. Export user list and prepare to reconcile users

3. Configure SSO in Org Admin

4. Reconcile user identities in your IdP with Bluebeam IDs in your organization

Create an Okta application for SSO and collect information for SSO configuration

You'll need to create a web application in Okta and then collect values you'll need in Configure SSO in Org Admin.

Create the Okta application for SSO

To create an Okta application for SSO, follow these steps:

1. In the Okta Admin Console, go to Applications > Applications > + Create App Integration.

2. On the Create a new app integration page, specify the following:

   • Sign-in method: OIDC - OpenID Connect

   • Application type: Web Application

3. Select Next.

4. On the New Web App Integration page, take the following actions:

   • Enter an App integration name for your OIDC SSO application.

   • Add the following Sign-in redirect URIs:

     • https://signin.bluebeam.com/oauth2/v1/authorize/callback

     • https://id.bluebeam.com/oidc/callback

     • https://signin.bluebeamstudio.co.uk/oauth2/v1/authorize/callback

     • https://signin.bluebeamstudio.de/oauth2/v1/authorize/callback

     • https://signin.bluebeamstudio.se/oauth2/v1/authorize/callback

     • https://signin.bluebeamstudio.com.au/oauth2/v1/authorize/callback

     • https://id.bluebeam.com/oidctest/callback

     Do not remove the default entry (http://localhost:8080/authorization-code/callback) from the list.

   • Under Assignments, select Allow everyone in your organization to access.:

     • Select Allow everyone in your organization to access.

     • Select Enable immediate access with Federation Broker Mode.

5. Select Save.

6. To configure user authentication, go to the Sign on tab for the application.

7. Scroll to User Authentication and select an authorization method.

8. Select Save.

Collect information for Configure SSO in Org Admin

To collect information you'll need for SSO configuration in Org Admin, follow these steps:

1. Select the General tab and copy the following information and paste it elsewhere for use during SSO configuration:

   • Client ID

   • Client Secret

2. In a browser, open the OIDC discovery document for your Okta authorization server to collect the configuration values you'll need in Org Admin. For more information, see the Okta developer documentation.

Create a policy for Bluebeam in Okta

This Bluebeam SSO configuration requires the authorization server in Okta Workforce Identity Cloud to have an access policy and rule that allows the Bluebeam OIDC application.

If you can't access Security > API in the Okta Admin Console, no action is required, and you can skip the procedure in this section.

If you can access Security > API in the Okta Admin Console, verify the default authorization server has an access policy assigned to "All Clients" and an associated rule that allows all scopes. If that policy and associated rule doesn't exist, follow these steps:

1. In the Okta Admin Console, go to Security > API, and edit the default Authorization Server.

2. Under Access Policies, select Add New Access Policy and provide the following values:

   • Name: Enter a name for your policy (Ex: Bluebeam).

   • Description: Enter a short description for your policy (Ex: Bluebeam).

   • Assign to: Select The following clients, then specify the app you created in Create an Okta application for SSO and collect information for SSO configuration.
   If you select All clients, the policy and the rule you create for it will apply to other applications created in Okta Workforce Identity Cloud.

3. Select Create Policy.

4. On the policy you created, select Add Rule.

5. On the Add Rule page, enter a name for your rule (Ex: Bluebeam), and retain all other selections.

6. Select Create rule.

Export user list from your IdP and prepare to reconcile users

As part of SSO configuration, you'll be asked to reconcile the users in your organization listed in your IdP against the list of users in your organization who have Bluebeam IDs (BBIDs) .

Reconciliation ensures that the user identities within Okta Workforce Identity Cloud match the BBIDs in the Bluebeam user database for users in your organization. If users in your organization chose their own BBIDs and passwords before you started SSO implementation, they could be using an email address as their BBID that doesn't match the email address you chose as the mapping value in your IdP.

Use the following procedure to export your user list and load it into our CSV template for the SSO reconciliation process:

1. Export your user list from Okta Workforce Identity Cloud using their instructions.
2. Open the exported user list.
3. Download and open our CSV template.
4. Copy the required user information from the exported user list to the defined cells of our template.
   
   

   Okta Workforce Identity Cloud Field Name	CSV Template Corresponding Column
   Last Name	lastName
   First Name	firstName
   Primary email	email

5. Find any rows in the file that contain empty cells, determine whether those users need BBIDs, and take the following actions:
   
   • If the empty cell appears in a row for a user who doesn't need a BBID, you can delete the row.
   • If the empty cell appears in a row for a user who needs a BBID:
     
     1. Find their entry in your IdP and provide the missing value.
     2. Export your user list from your IdP again, and go to Step 4 above.
     If you didn't have to perform these substeps for any users, continue to Step 6.
6. Save the CSV file for use when you configure SSO in Org Admin.

Configure SSO in Org Admin

To complete SSO configuration, set up SSO access to Bluebeam products and services for end users in your organization who are listed with your IdP. You'll also reconcile the list of your users in Okta Workforce Identity Cloud with the list of your users in our system who have BBIDs to ensure your end users' Okta user IDs match their BBIDs.

To configure SSO, go to Org Admin and follow these steps:

1. Under Accounts, select the account you want to manage.

2. Select Settings.

3. Next to SSO Configuration, select Configure.
4. Select OpenID Connect.
   
5. When prompted, provide the following requested information that you collected from Okta earlier: 
   • Issuer
   • Authorization Endpoint
   • Token Endpoint
   • JWKS URI
   • UserInfo Endpoint
   • Client ID
   • Client Secret
6. Select Submit.
7. In the OpenID Connect Configuration dialog, specify the verified domain(s) you want configured to your account, and select Next.
8. To "Map service provider attribute to available fields," keep the default entries.
9. Select Sign in to Test SSO.
10. When prompted, use an account that has a Studio BBID to sign in.
    The tests "Connection" and "User Attributes" must be successful before you can continue.
11. Return to Org Admin.
12. Select Continue.
13. Select Next to provide a list of your users and complete the SSO configuration.

14. Upload the CSV file you created earlier.

15. Select Next.

    Select Finish Later to save your progress, leave this procedure, and continue at a later time.
16. When prompted, select Close to continue SSO configuration.

You'll be returned to the Settings tab, where you can verify that the domain(s) you selected for your organization appear and then continue SSO configuration.

We'll cross reference BBIDs we find within your organization with user IDs for your organization in Okta Workforce Identity Cloud. We'll send you an email with the subject "Continue SSO Configuration" when this process completes and you can start the reconciliation process necessary to complete SSO configuration.

Reconcile user identities in your IdP with BBIDs in your organization

Reconciliation ensures that the user identities within Okta Workforce Identity Cloud match the BBIDs in the Bluebeam user database for users in your organization. If users in your organization chose their own BBIDs and passwords before you started SSO implementation, they could be using an email address as their BBID that doesn't match the email address you chose as the mapping value in your IdP.

Reconciliation focuses on users' Studio data. If you continue SSO configuration without performing the reconciliation process, these unmatched users will lose access to their existing Studio Projects and Sessions. Specifically, unmatched users will lose access to the following:

• Active Studio Sessions or Studio Projects they own

• Markups they own in active Studio Sessions

When the "Continue SSO Configuration" email arrives, open it and take the following steps:

1. Select Continue SSO Configuration to open Org Admin to the Settings page.

2. Next to "SSO Configuration," select Continue to see a list of users in your account we couldn't match with users in our database.

3. Update or ignore user information that appears as "Not Matched."

The "Not Matched" list includes unmatched users who have accessed Studio in the past six months. The list is sorted by "Last Studio Login," which helps you prioritize the users most likely to need reconciliation. The rest of this section addresses questions about users appearing on the list and describes the actions you can take to complete reconciliation.

Why are some users listed as "Not Matched"?

After reconciliation compares user identities from your IdP to those in the Bluebeam database, some could be listed as "Not Matched." Users can be listed as unmatched for a variety of reasons, including the following:

• The user is no longer with your organization.

• The user changed their email address in your IdP, but did not do so with their Bluebeam account.

• The original email address was entered incorrectly.

• The user has Studio data associated with an older email address.

For example, the list of BBIDs we have stored could include users who are either no longer with your organization, have had name changes, or had mistakes in their email addresses when originally added. Reconciliation allows you to evaluate the users listed as "Not Matched" to determine whether they should be provisioned for SSO access or if the configuration process can ignore those users.

When you see this screen, you can:

• Select Re-upload User List if your CSV file contains errors you need to correct.

• Select Save & Finish Later if you want to save your progress and address the unmatched users later.

• Select one or more users to ignore and not configure for SSO, because they are either no longer with your organization or don't need access to Bluebeam products and services.

• Select one or more users to update the New Bluebeam ID From Directory field. This action would be necessary if a user needs subscription access to Bluebeam products and services, or their email information changed with your organization, but their BBID in our database did not change.

Why does a user appear multiple times?

If a user appears multiple times but in different Studio regions, reconcile that user for each region to ensure they don't lose access to those Studio Projects or Studio Sessions.

When to "Ignore Users"

Many unmatched users are those who are either no longer in your organization or don't need a BBID. When you see the list of unmatched users, hover over the information icon () next to an unmatched user's current BBID to review their Studio activity. The information displayed is:

• Last Studio Login
• Sessions Owned
• Sessions Attended
• Projects Owned
• Project Memberships

If you determine that a user is either a former employee or otherwise doesn't require SSO access to Bluebeam products and services, select "Not Matched," then select "Ignore User" to exclude the user from SSO configuration for your organization.

To ignore more than one user, select multiple users and select "Ignore User."

When to edit "New Bluebeam ID From Directory"

If a user needs to be updated, select Edit, select "Not Matched," and provide the user's email address from the IdP. After you update the matching information, notify the user(s) that they will need to use the new BBID going forward and, if necessary, log out and log back in using the new BBID.

Select Show All Users to verify that every user in the list is either "Ignored" or indicates "No Change."

Activate SSO

After you ignore or update unmatched users, select Activate to complete SSO configuration. If you want to continue to SCIM configuration for your organization, see Configure SCIM for Bluebeam Accounts.

Disable SSO

Use Org Admin if you need to disable SSO for your organization.

If you configured SCIM for your organization, you may disable SCIM and keep SSO configured, but if you want to disable SSO, you must first disable SCIM.