Intranet and Internal Employee Forms Behind SSO

Internal employee forms with SSO tie each submission to a verified employee and remove the separate password that a standalone form tool would add. Internal employee forms carry requests that touch payroll, benefits, equipment, access, and performance, so they belong behind single sign-on (SSO).

The National Institute of Standards and Technology describes the federation model behind SSO in SP 800-63C. In that model, the organization’s directory authenticates the employee, and the form platform accepts the verified identity.

Key Takeaways

• Internal employee forms with SSO tie every submission to a verified employee identity.
• Single sign-on removes the separate password that a standalone form tool adds.
• In SSO federation for internal forms, the organization’s directory acts as the identity provider, and the form platform acts as the relying party.
• Disabling a person in the directory ends access to every connected form in the same step.
• Forms outside the identity provider, anonymous links, and account-level permissions are the three common gaps in internal form programs.
• FormAssembly supports SAML and CAS single sign-on, prefill, approvals, and role-based access for internal employee forms.

How SSO Federation Works for Internal Forms

SSO federation, as the National Institute of Standards and Technology describes it in SP 800-63C, lets an identity provider (IdP) authenticate a person and tell a relying party about that person. The federation sequence runs in four steps:

1. The IdP authenticates the person.
2. The IdP sends an assertion, which NIST defines as a verifiable statement about the subscriber account.
3. The relying party validates the assertion.
4. The relying party creates an authenticated session and grants access.

Under federation, the person uses services from multiple relying parties without holding a separate authenticator at each one. NIST notes that organizations federate inside one security domain for centralized account management and easier technical integration. For an internal employee form, the IdP is the organization’s directory, and the form platform is the relying party.

What SSO Changes for Internal Employee Forms

Single sign-on changes four things for internal employee forms:

• Identity comes with the login. The form knows who the submitter is without asking, and name, email, department, and manager can prefill, which removes typing and the errors that come with it.
• Routing follows the org chart. A request from an employee can route to that employee’s manager, a request above a set amount can route to a second approver, and approvers act on a record tied to a real identity.
• Offboarding closes access. When HR disables a person in the directory, access to every connected form ends in the same step, so no one needs to remember to remove an account from a form tool.
• Audit records mean something. An audit trail that names a verified user answers who submitted, who approved, and who viewed.

Common Gaps in Internal Employee Form Programs

Three gaps weaken internal employee form programs:

• Forms outside the identity provider. Teams stand up forms in tools that sit outside the identity provider, so the form has no link to employee status.
• Anonymous links. Anonymous links let anyone with the URL submit, which makes internal requests look the same as outside requests.
• Account-level permissions. Permissions stop at the account level, so any builder can see every form.

A governed internal form program closes each gap with SSO, authentication on each form, and permissions by form or team.

What to Look for in an Internal Employee Form Platform

An internal employee form platform should meet four criteria:

• The platform supports SAML and CAS so it fits the organization’s identity provider.
• The platform offers role-based permissions that limit who can build, edit, and view.
• The platform prefills known data and routes approvals based on submitted values.
• The platform keeps an audit trail that records access as well as edits.

Where FormAssembly Fits

At FormAssembly, we support SAML and CAS single sign-on, so employees reach internal forms with the same login they use for other company systems. Our platform adds three controls for internal forms:

• Our prefill fills known details into the form.
• Our approvals route requests to the right manager.
• Our role-based access limits who builds and views each form.

IT teams at higher education institutions and government agencies can replace scattered internal forms with one governed platform and keep the audit trail in one place.

Frequently Asked Questions

Why should internal employee forms sit behind SSO?

Internal employee forms with SSO tie each submission to a verified employee and remove the separate password that a standalone form tool adds. Internal forms carry requests that touch payroll, benefits, equipment, access, and performance, so a verified identity matters for routing and audit.

What happens to internal form access when an employee leaves?

When HR disables a person in the directory, SSO ends access to every connected form in the same step. No one needs to remember to remove an account from a separate form tool.

What is an SSO assertion?

NIST defines an assertion as a verifiable statement about the subscriber account. In SSO for internal employee forms, the identity provider sends the assertion, and the form platform validates the assertion, creates an authenticated session, and grants access.

Which SSO protocols does FormAssembly support for internal forms?

We support SAML and CAS single sign-on, so our forms fit the organization’s identity provider. Employees reach internal forms with the same login they use for other company systems, and our role-based access limits who builds and views each form.