HealthyRides

Sign-in and single sign-on

How people sign in to HealthyRides, and what your IT team sets up for single sign-on.

HealthyRides does not keep passwords. Sign-in runs through WorkOS, an identity service: Sign in takes you to its sign-in page, and it hands you back to HealthyRides once you are through.

How a person gets in

  1. An administrator invites them by email, with a role. See Invites and memberships.
  2. They follow the invitation and sign in. WorkOS tells HealthyRides which organization they belong to and which roles they hold. Nobody types or picks an organization.
  3. They land on their role's first screen.

A person belongs to one organization. There is no organization switcher.

Finish signing in within 10 minutes of starting. After that the attempt lapses and you see Your sign-in took too long; Sign in again works. If you see You need an invitation, ask your administrator to invite you. Your organization is not set up yet means HealthyRides has not finished setting up your organization; contact HealthyRides support.

Single sign-on

Your organization can have its people sign in with your own identity provider, such as Okta, over SAML or OpenID Connect. Without it, members sign in with their email address.

Your IT team sets the connection up in the WorkOS Admin Portal:

  1. A facility or provider administrator opens Admin, then Authentication.
  2. Under Single sign-on and MFA, Manage in WorkOS opens a one-time link to the Admin Portal in a new tab.
  3. Your IT team enters your identity provider's details there.

The Authentication tab then lists each connection by its type, such as "Okta SAML", with its state: Active, Validating, Draft or Inactive. The list is read live from WorkOS each time. See Authentication.

Multi-factor authentication is also managed in WorkOS, not on this tab.

How long a session lasts

  • A session ends 14 days after sign-in, however much it is used.
  • An administrator can also sign members out after a period with no activity. Facility organizations start at 15 minutes. Provider organizations start with it off. See Authentication.
  • Access is checked on every request. A person who is suspended or removed is signed out on their next click, not when their session would have ended. A role change also applies on their next click.

Sign out ends the session in HealthyRides and at WorkOS, so the next person at a shared workstation is not signed back in as you.

This video is not published yet.