In Vault, user accounts exist within a single domain. By setting up cross-domain users, Admins can grant a user access to Vaults on a different domain without creating a new user account. For example, Admins in VeePharm’s PromoMats Vault could set up agency users as cross-domain users. These users would exist in their agency’s Vault, which would be on their “home” domain, but would also be able to access the PromoMats Vault on the VeePharm domain in order to upload materials they create. For agencies that work with many different companies, this saves users from having to manage several different Vault login accounts.
Cross-domain users can log in to any Vault they have access to using their existing home domain login credentials or using SSO with their corporate IdP. Cross-domain users navigate to any Vault they have access to via the Vault selector drop-down menu or the My Vaults page.
How to Create Cross-Domain Users
To create a cross-domain user:
- Navigate to the Admin > Users & Groups > Vault Users page and select Create Cross Domain User from the Actions menu.
- In the Add Existing User dialog, enter the user’s full user name in the User Name field.
- Select the License Type and Security Profile. Vault auto-fills the remaining required profile fields based on the existing user information from the home domain. Vault also automatically assigns the Cross Domain Security Policy for the new user. If the License Type field is not visible, manage application-specific licensing in the next step.
- Optional: Select a license value for each application. You must select a license value for at least one application. Some license values may be unavailable depending on the application.
Note: The auto-created Cross Domain Security Policy is not visible in Admin and is not editable.
Synced User Fields
If an update occurs on one (1) of the following fields on a User record on the home domain, it is synced to the same fields on that User record on all cross-domains:
- First Name
- Last Name
- Company Name
- Username
- Language
- Locale
- Timezone
- Product Announcement Emails
- Service Availability Notifications
Cross-Domain User Authentication
The login authentication process differs based on if the cross-domain user utilizes a password or SSO security policy in their home domain.
Password User Authentication
Cross-domain users with a password security policy in their home domain can access a cross-domain Vault through their existing home domain using their login credentials. If the user logs in through the default login page, they can access Vaults in a cross or home domain from the Vault selector drop-down menu or the My Vaults page. During an active login session, cross domain users can navigate between cross and home domain Vaults without having to re-enter their login credentials.
SSO User Authentication
Cross-domain users with an SSO security policy on their home domain can access a cross-domain Vault through their existing home domain using their corporate IdP credentials. If a user logs into a cross-domain for the first time, Vault prompts them to enter their user name before redirecting to their corporate IdP. Once the user logs in successfully through their IdP, the user can access the specified cross-domain Vault.
If a cross-domain user logs in through the default login page, they can access Vaults in a cross or home domain from the Vault selector drop-down menu or the My Vaults page. During an active session, cross-domain users can navigate between cross-domain and home-domain Vaults without having to re-enter their login credentials.
Permissions
Admins with the Admin: Users permissions can access user management options and create cross-domain users.
FAQ
Does a trust need to be set up between a home domain and a cross-domain before cross-domain users can be created?
No. The ability to create cross-domain users is enabled by default on all domains.
Do cross-domain users login through a specific Vault, a domain, or Vault platform?
Cross-domain users log into their home domain, but the session is Vault specific. The My Vaults page, if enabled, is served from the cross-domain user’s Vault on their home domain.