Single sign-on authentication

Thomson Reuters uses the PingFederate solution from Ping Identity for our Federated single sign-on (SSO), including ONESOURCE. This capability enables you to authenticate on your corporate network first and then automatically authenticate to Thomson Reuters applications with single sign-on (SSO) technology.
Thomson Reuters supports the SAML 2.0 protocol. This is by far the most common SSO protocol in use today. We support both SP and IdP-initiated SSO using the Browser/POST profile.
Thomson Reuters doesn’t support any other SSO protocol, including all non-standard customer-specific custom protocols.

Authenticate using SSO

After logging in to your corporate network, you'll have direct access to your application. If you don't have an SSO, you'll authenticate twice. You'll sign in to your corporate network and then sign in to a Thomson Reuters application such as ONESOURCE Platform.
note
ONESOURCE Platform doesn't support single logout (SLO), and we haven't added this capability in PingFederate. For control over the customer authentication session, you can manage that on the customer side. If you need to reauthentication if a user tries to use the customer IDP to get back to ONESOURCE, you can enforce that with a policy on your side. In practice, the industry doesn’t support SLO.

Single sign-on for specific ONESOURCE applications

For ONESOURCE applications, users can only directly single sign-on into the ONESOURCE Platform web portal as the target application. ONESOURCE applications use the normal launching mechanisms for access, like ONESOURCE Income Tax or ONESOURCE Tax Provision. The ONESOURCE Platform supports immediately launching a specific ONESOURCE application during the single sign-on sign in for customers that always use a specific application through an additional parameter on the target application URL (like "?OSTARGET=https://www.application.com").
note
The ONESOURCE Platform window displays along with the launched target application.