Good Grants supports 3rd party authentication so users can register and sign in using external accounts. This includes social login (Facebook, Google, LinkedIn, etc.) and enterprise authentication via SAML single sign-on (SSO). You can also build your own integration using the API.
Social authentication is available on all plans. API access is available on Premium plans and above. SAML is included with Enterprise subscriptions and is available as a paid add-on for all other plans.
Enable 3rd party authentication
- In the Manage workspace, go to Settings > Users > Registration
- Select Enable registration via 3rd party authentication
- In the '3rd party authentication' section, choose the providers you want to enable
- Click Save
If you want to disable Good Grants's default login, select 3rd party authentication only.
Social authentication
Good Grants supports login via:
- Twitter / X
- WordPress / Drupal (with plugin)
After enabling your chosen providers, social login buttons appear on your program’s home page.
How it works:
On their first login, users are redirected to the provider to confirm their identity.
The provider displays its own consent screen.
If a user declines consent, they can cancel and register normally.
SAML authentication
SAML (Security Assertion Markup Language) is a standard for exchanging authentication and authorisation data between your identity provider and Good Grants (service provider).
Good Grants supports both:
- Service-provider-initiated login – button on your Good Grants login page
- Identity-provider-initiated login – link from your organisation’s intranet
You can select which role users who register using SAML are granted using the Role for new users drop-down.
Configure SAML
- In the Manage workspace, go to Settings > Users > Registration
- Ensure Enable registration via 3rd party authentication is selected
- Under '3rd party authentication', select SAML
- Enter:
- Issuer
- Single sign-on service URL
- X.509 certificate
- If needed, enable certificate encryption and enter your public/private key
- Click Save
When your identity provider needs Good Grants metadata
Some IdPs (e.g. Microsoft Azure) need service provider details before generating certificates. Use:
- Entity ID: https://<your_account_url>/saml/metadata
- Reply URL (ACS): https://<your_account_url>/saml/callback
Required SAML attributes
Your IdP must send these attributes, and they must match exactly:
- firstName
- lastName
NameID should be set to persistent.
Account linking
When a user signs in using SAML Good Grants checks whether their email already exists.
- If not, a new user account is created automatically.
- If yes, the user can link their existing Good Grants account by entering a verification code sent by email.
Verification codes expire after 10 minutes but can be regenerated (previous codes become invalid).
Service provider metadata
Once SAML is configured, you will see a Service provider metadata link at the bottom of the Integration tab.
The metadata XML includes:
- entityID URL
- Reply URL (ACS): https://<account_url>/saml/callback
- Required attributes (firstName, lastName, email)
Each account has unique metadata.
Building your own SSO integration
If you prefer to build your own authentication flow, you can use the Good Grants API to:
- Check if a user exists
- Create the user (if they do not exist)
- Generate an auth token
- Redirect the user into Good Grants signed in
Check if the user exists
GET: https://api.cr4ce.com/user/:email
- If the user exists, the response includes their slug (required for the next step).
Get an auth token
GET: https://api.cr4ce.com/user/:slug/auth-token
- Response includes: "auth_token": "..."
Redirect the user into Good Grants
https://<ACCOUNT_DOMAIN>/login?token=<TOKEN>
Create a user (if needed)
POST: https://api.cr4ce.com/user
- Body must include first name, last name, email, password at minimum.
- The response includes the user’s slug.
For full details, go to Settings > Integrations > API documentation.
Good to know
- Social login cannot override privacy or consent requirements set by the identity provider.
- SAML logins always require three attributes: firstName, lastName, and email.
- You can disable standard login entirely if you want authentication to occur only through your identity provider.
- User roles for SAML accounts default to your system’s default role.
- The API allows total flexibility if your organisation uses a non-standard SSO tool.
FAQs
Cost and plans
Is there a cost for SAML?
Yes. SAML is included with an Enterprise subscription but can be added to any plan as a paid add-on.
If we have multiple Good Grants accounts, does each one require a SAML purchase?
Yes. Each account that requires SAML needs its own subscription.
What options do we have if we do not purchase SAML?
Your users can register using the default Good Grants flow or use social authentication (Facebook, Twitter / X, Google, and others).
Configuration and integration
Can we use our own system?
Yes. You can build your own SSO integration using the Good Grants API.
Can we disable standard login and enforce SAML-only access?
Yes. Grant managers can disable standard login entirely to enforce SSO-only access via SAML.
What if SAML is down? How can admins access the account?
If SAML is unavailable, admins can access the account using the normal login process (standard username and password). Alternatively, enable another third-party method such as Google as a fallback. For uninterrupted access, we recommend configuring at least one standard admin account that does not rely on SAML.
Does Good Grants support SCIM provisioning?
No. SCIM provisioning is not currently supported. There is an existing feature request on the roadmap with no confirmed timeframe.
Does Good Grants support just-in-time (JIT) provisioning?
Yes. JIT provisioning is supported and is the recommended approach.
Does Good Grants support SAML single logout?
No. Single logout is not currently supported.
Are additional custom claims supported?
No. Good Grants does not support additional custom claims beyond firstName, lastName, email, and NameID.
What permissions or admin consent is required from the identity provider?
This depends on your identity provider configuration. You will typically need the correct level of credentials to create and configure the integration. Consult your identity provider's documentation for specific requirements.
Certificates and security
Does Good Grants support planned certificate rollover or auto-renewal?
No. Good Grants supports configuring an X.509 certificate but does not support automatic rollover or renewal. You must update certificates manually before they expire.
How does certificate rollover work?
You must update the certificate manually in your account settings. While your identity provider may support two active certificates at once, Good Grants references only one certificate at any time. Plan your rollover process accordingly.
Users and provisioning
What identity attributes are required?
firstName, lastName, email, and NameID (set to persistent). Attribute names must match exactly, and the email address is the primary identifier for linking and provisioning.
How are users created when SAML is enabled?
Users are created via JIT provisioning on first SAML login. If the email does not already exist, a new account is created automatically. If it exists, the user can link their existing account using an email verification code. The email in the identity provider must match any existing account exactly, or a new user will be created.
Can I manually create SAML users?
Yes. Create users via the Users section, or let them self-register if registration is enabled. These users can later link to SAML on first login with their identity provider credentials, provided the email addresses match.
Can users update their profile information after SAML login?
Yes. Users can update their profile information (such as name and email) via their user profile. However, changes in the platform are not reflected in the identity provider, and changes in the identity provider are not reflected in the platform. Users should update their details in the platform directly.
What role do SAML users receive?
SAML users are assigned the default role configured in the account. By default this is applicant, but grant managers can configure a different default role.