Deem Mobile Application Sign-In

To sign-in to the Deem Mobile Application, the Deem account email address and password is used.

This can be different from signing in to the Deem Application where the user signs in with a username and password or with sign-on credentials from another application called Single Sign On (SSO).

Finding your mobile sign-in email address

If you do not use the Deem account email address to sign-in to the Deem Application, you can find your Deem Mobile email address in the Deem Application.

In the New UI, the mobile link is displayed in the Mobile Popup accessible from the footer of every page.

 Image Removed

Or, if you are using the older version of our UI, it is displayed in the Mobile page accessible from the Mobile tab at the top of every page.

Click the Mobile tab and your sign in email will display on the Mobile | Download Deem page. 

 Image Removed

Image Removed 

Establishing your mobile sign-in password

If you do use a password to sign-in to the Deem Application, use this same password to sign-in to the Deem Mobile Application.

• Enter your email and password and tap the Sign In button. 

If you use sign on credentials from another application commonly called Single Sign On (SSO) to sign-in to the Deem Application, you will need to establish a password to use to sign-in to the Deem Mobile Application.

The easiest way to establish a password is to use the Deem Mobile Application.

...

Below is the high-level diagram for the Mobile SSO User Experience flow.

Mobile SSO Qualifications

• Desktop SSO must be implemented.
  • Please see: Implementing Single Sign-On (SSO) for Desktop for more information.
• Deem Mobile Application opens a secure and private In App Browser to initiate the SAML authentication flow.
• Both SP-Initiated and IdP-Initiated are supported.
• Mobile SSO uses the same Console Site SSO Configurations as Desktop SSO.
  There are 2 Mobile specific settings, Enable Mobile SSO and Mobile Company SSO End Point,
• The user account must exist and be active to login using Mobile SSO.
  NOTE: Mobile SSO does not include profile provisioning like Desktop SSO. 
• If the site is configured for Hybrid SSO (both Username/Password and SSO authentication), then the Deem Mobile Application will only support SSO authentication.
  Only users who have access to the customer's SSO Service will be able to sign in to the Deem Mobile Application.

Configuring Mobile SSO

Shared Desktop and Mobile Configuration

To configure Desktop and Mobile SSO together, two applications in your SSO Service will need to be configured, one for Desktop and one for Mobile.
The Mobile application will be configured with a Virtual Server Id so the SAML assertion will be processed for mobile.
The Virtual Server Id can be a string or URL but must be a different URL than the Desktop Application SAML Audience.
The following information is needed to configure your SSO Service.

• Desktop Application SAML Endpoint: https://go.deem.com/sp/ACS.saml2

• Desktop Application SAML Audience: https://go.deem.com
• Mobile Application SAML Endpoint: https://go.deem.com/sp/<Base64 Encoded Element of PingFederate Virtual Server Id>/ACS.saml2
  The element decoded is of the form {“vsid”:“<virtual-server-id>”}
• Mobile Application SAML Audience: <PingFederate Virtual Server Id>

• Relay State: If configuring for IdP-Initiated and multiple sites, a unique URL for your Deem domains that should be included with the SAML assertions. Your Deem Integrations Manager will provide these URLs.

The following information is required for Deem to complete the configuration.

• Issuer: The same unique identifier for Desktop SSO that represents you as a customer in the SAML assertion. Typically, this is a string or a URL.
• The X509 Certificate that is used to digitally sign your SAML assertions. This will be used by Deem to validate the SAML assertions you send.
• Mobile Company SSO Endpoint URL: If configuring for IdP-Initiated, this is the URL that the Deem Mobile Application will open to initiate the SAML authentication flow.

Separate Mobile Configuration

To configure Mobile SSO separately from Desktop SSO is simpler.
The following information is needed to configure your SSO Service. 
Note: This information is the same for Desktop SSO. (please see Implementing Single Sign-On (SSO) for Desktop for more information)

• Deem SAML Endpoint: https://go.deem.com/sp/ACS.saml2
• SAML Audience: https://go.deem.com
• Relay State: If configuring for IdP-Initiated and multiple sites, a unique URL for your Deem domains that should be included with the SAML assertions. Your Deem Integrations Manager will provide these URLs.

The following information is required for Deem to complete the configuration.

• Issuer: A unique identifier for mobile that represents you as a customer in the SAML assertion. Typically, this is a string or a URL.
• The X509 Certificate that is used to digitally sign your SAML assertions. This will be used by Deem to validate the SAML assertions you send.
• Mobile Company SSO Endpoint URL: If configuring for IdP-Initiated, this is the URL that the Deem Mobile Application will open to initiate the SAML authentication flow.

Sample Mobile SAML Response and Assertion