PLEASE NOTE: In order to improve the security of your platform, as of November 1, 2021, Docebo will discontinue supporting second-level domains. If you have configured your custom domain as a pure second-level domain (i.e. mydomain.com), please update it to a third-level domain (i.e. www.mydomain.com or subdomain.mydomain.com) as described in the Knowledge Base article on custom domains, before November 1, 2021, in order to comply with the new standard. Check out the Product Updates page for more details.
Introduction
Docebo's Extended Enterprise App is a useful tool that allows you to rebrand your platform to show customized branding elements for each organizational chart node.
To activate this app, please contact your Sales account.
Use Case Scenarios
The Extended Enterprise app can serve different scenarios, one of them is self-registration. For example, the branch that is assigned to an extended enterprise has sub-branches nested under it. Users can self-register and when doing so, they need to select the sub-branch they are associated with and be placed into that sub-branch rather than the extended enterprise branch. Users will be required to enter a branch code or to choose a branch from a dropdown of available branches to identify their branch placement.
Configuring Global Settings for Your Extended Enterprise
Start your configuration by managing the global settings of the app. Log into your platform as the Superadmin, then select the gear icon from the top right corner of the page to access the Admin Menu. Find the Extended Enterprise section, then press the Settings subitem.
On the Settings page, flag the option to enable login restrictions for the users of your extended enterprise. When this option is enabled, users will be able to log in only to the domain they belong to. This option can only be flagged globally (for all of the Extended Enterprise clients), it is not possible to set this restriction at domain level.
Please note that when this option is NOT flagged, if users attempt to access a domain of the extended enterprise to which they are not assigned, a domain selection page will be displayed for the selection of a domain to which they have access. The page lists all of the platforms that the user has permission to access. He or she simply needs to click in the platform’s name and log into that platform.
Please remember that this page only appears when the Enable Extended Enterprise Login Restriction option is NOT flagged on the Settings page for the Extended Enterprise app. When this option is enabled, if a user attempts to access an extended enterprise platform to which he or she is not assigned, he or she will receive an error message and will not be allowed to log in.
Please note that as a Superadmin, you are always allowed to access any extended enterprise platform, so the domain selection page will not be displayed when logging into the platform as a Superadmin.
In addition, every user is always allowed to access the main domain, as every user is associated with the root branch.
Creating Clients for Your Extended Enterprise
You can create clients for your Extended Enterprise by accessing the main Extended Enterprise management page. Reach the Admin Menu, then press the Manage item in the Extended Enterprise section. Press the New Client button at the top of the page. In the pop-up box, assign a name to the client, and choose if you want to assign a new domain, or use a subdomain from your platform. You can also choose to create a subfolder instead, if desired. Please note that your Docebo platform only takes domains up to the third level. For reference:
- Third level: An example of a third-level domain is subdomain.yourcompany.com or www.yourcompany.com. Here, you will only need to confirm the CNAME, as yourcompany.docebosaas.com.
- Second level: An example of a third-level custom domain is yourcompany.com. Starting on November 1, 2021, Docebo will discontinue supporting second-level domains.
Any level beyond this will not work. Keep in mind that any subdomain you want to use must be registered with an Internet Service Provider (ISP). We strongly suggest not to use 4th-level domains as you may experience problems with HTTPS certificates.
Press Next to proceed. Now assign a branch of your organizational chart to this customer, then press Next. Please note that you can only assign one extended enterprise client to a user branch in your platform. Multiple extended enterprise clients cannot be added to a single branch. If you try to add an extended enterprise client to a branch that already has an assigned client, you will receive an error message. Now, users will be able to see a different color scheme, URL, logo, homepage image, and course player based on their organizational chart node.
Please note: When you are selecting the branch of your organization chart to associate with specifc domain, please note that in order to make it easier and faster to select branches, you will see a text input field to type in branch names rather than a list of branches to select if you have more than 1,000 branches in your platform.
Users of this branch will have their own URL to access the platform. When you create your Docebo installation, you will first choose a default domain name for your new platform (e.g. elearningbox.com), but the intention with this app is that by using custom URLs, you can assign additional domain names to the same Docebo installation.
Managing Client Preferences & Themes
To manage client settings and preferences, find the client in the list of clients on the bottom half of the main Extended Enterprise page, then press the Settings icon (gears icon) in the client's row. On the client's Settings page, there are various tabs on the left side of the page that organize how you can manage this client. At the top of the page, press the Configure Theme button to change which theme is applied for this client, or press the pen and paper icon to edit any details that you inserted when you first created the client.
Docebo White Label Tab
For those using Docebo's White Label, you can apply White Label settings to specific extended enterprise clients, or adjust various parts of the theme in this tab. Please note that the options in this tab change depending on which theme you've selected for the client, so you should refer to the corresponding articles linked in this section for more information about the options in this area.
HTTPS Tab
If you have activated the Custom Domain Https app, you can upload and install your SSL certificate for each domain configured via this app. Refer to this article to learn more. When finished, press Save.
Course Catalog Tab
In this tab, you can apply specific settings related to internal or external course catalogs. In order to enable the customization of this area, select the option Enable custom settings for this client, otherwise, users assigned to this folder will see the standard course catalog settings.
Then, you can flag whether you want to use a category tree for the catalog, as well as show the catalog to non-authenticated users. When activating this option, remember that courses and training materials reside at a global level. Subsequently, the categories used to organize them are also at the global level, but they can be assigned to catalogs across the domains.
You can also choose whether to show all available public courses or learning plans, or choose to display a specific catalog. Define whether to enable the Share this View button in the top right corner of domain internal and external catalogs and in the Course Catalogs tab of the domain Global Search results page so that users can use it to copy the page link on their clipboard in order to share the filtered results of their search within the catalog with other users.
Please refer to the Advanced Filtering article for further information on sharing filtered page deeplinks. This option activates the Share this View button in the catalog page; if the catalog is displayed in a Catalog Widget, activate the button in the pages including the widget. Refer to this article of our knowledge base for further information on widget pages. Press Save Changes when finished.
Virtual Coach Tab
This tab allows you to apply specific settings for the Virtual Coach, by enabling or disabling the functionality at domain level. Select Enable custom settings for this client and configure settings as needed. Remember that the Virtual Coach is activated by default in all of the domains.
Press Save Changes when finished.
E-Commerce Tab
This tab allows you to apply specific E-Commerce settings (assign the currency, account, payment gateways and wire transfer options) for the selected client. In order to enable the customization of this area, select the option Enable custom settings for this client. Now, you can insert a specific currency symbol to display to the end-users of this client and select a currency from the dropdown menu.
Press Save Changes when finished.
Self Registration Tab
In this tab, you can apply a specific registration type to users in this domain. Begin by flagging the option to enable custom settings for the client. Then, flag whether you want to allow quick registration for these learners when they register into the platform.
Next, select whether these users can have free self-registration, moderated self-registration, or only-by-administrator registration. Refer to this article to learn more about the different registration types.
You can also flag the option to not send the confirmation email to users upon self-registration if you've allowed free or moderated self-registration, but please note that flagging this option means that you will have to manually send users their credentials.
Next, you can restrict user registration into the platform to a specific email domain, so users registering themselves using an email with a different domain will be automatically rejected. Define the domains that are allowed by inserting the list of domains in the Restrict Domains field.
Please Note: This feature only works with the self-registration and the moderated registration policies.
Press Save Changes when finished.
Auth0 Settings Tab
In this tab, you can activate Auth0 for this specific client. With this integration, you can allow users to log into their Docebo platforms using credentials from an active session of other web platforms. Refer to this article for more information.
LDAP App Settings Tab
If you have activated the LDAP app, you can assign a specific LDAP configuration to each domain you have in your extended enterprise platform. Users who access the platform from different URLs will be able to authenticate their credentials through different LDAP systems. Please refer to this article to learn how to activate and set up LDAP. When finished, press Save Changes.
OpenID Connect Settings Tab
If you have activated the OpenID Connect app, you can assign a specific OpenID Connect configuration to each domain you have in your extended enterprise platform. Please refer to this article to learn how to activate and set up OpenID Connect. When finished, press Save Changes.
SAML 2.0 Settings Tab
SAML 2.0 allows users to use SAML to sign in between their active directory and the platform for each extended enterprise client. Activating this app allows your users to log in to their computer and, with an active session, also sign into the Docebo platform, using the domain assigned to each one by the Extended Enterprise app.
To learn more about the settings in this tab, refer to this article. Press Save Changes when finished.
In a multi-domain scenario where different instances are leveraging different SSO protocols, either Auth0, LDAP, OpenID Connect or SAML can be configured at the domain level. However, if the API and SSO app is being leveraged at the root level to include the Force External SSO option, it will supersede the multi-domain SSO settings and thus apply to the entire domain. This is likely to affect a use case where you wish to set up a service-provider-initiated SSO on a multi-domain.
Language Settings Tab
Use this tab to manage the active set of languages and assign a default language for the clients of your extended enterprise. To edit the languages, flag the option to Enable custom settings for this client. The language list below will no longer be greyed out.
In the last column for each row, you will see a checkmark to activate or deactivate a language. Simply click the checkmark to do so. A green checkmark means the language is active, and a grey checkmark means the language is not active.
In the Default column, you can click on a flag in a language’s row to make the flag green, thus setting it as the default language for that client.
Subscription Settings Tab
For those using the subscriptions module in Docebo, you can apply specific settings to a client of your extended enterprise, overriding any global settings that you configured for the module. Simply flag the option at the top of the tab to enable custom settings for the client, then flag any of the subscription options that you want to apply. To learn more about these options, refer to this article. When finished, press Save Changes.
User Options Tab
In this tab, you can flag various options to apply to this client when creating users or when they are logging into the platform. Begin by flagging the option to enable custom settings for the client.
Now, flag whether you want new users that you create to have auto-calculated passwords upon creation, and if you want to consider the email addresses of the new users as either username for the platform as well.
Enable the Prevent users from changing their password so that users will not see the Change Password tab in the My Profile area (on desktop and on mobile), in the My Profile widget as well as the password reset option in the login form. This option applies to both the desktop and the mobile versions of the platform. Please note that this option is enabled by default when the Show only SSO buttons and hide login form toggle is enabled in the Configure Branding and Look menu of your platform so that users logging into the platform with the Single Sign On do not have the option to change their password in the platform, and will keep the one set in the Identity Provider.
Set the option to hide the My Profile and the My Preferences sections in the user My Profile area to hide the Preferences tab and all fields except for the avatar image in the Personal Info tab to users and Power Users. Superadmins can see the Preferences tab.
Use the Use Email as Username option to use email addresses as usernames. When enabling this option, make sure that your users are associated with valid email addresses. Please note that when this option is active, the email address used as the username is the one associate to the user at the user creation time. If users update their email address in their My Profile area, the username is not updated to reflect the new email address.
Flag whether you want to enable the Remember Me functionality on the login page for this client. By flagging this option, users won’t have to provide their login credentials again after the first login on a specific device.
Privacy Policy Tab
Whether you have activated the privacy policy globally from your main domain or not, you can locally activate or deactivate the privacy policy for a subdomain in the Extended Enterprise settings. Remember that local settings take priority over the global configuration for the privacy policy, so any settings that you configure for that subdomain will always override any global privacy policy settings that you’ve configured.
In the Privacy Policy tab, flag the option in the first section to Enable custom settings for this client. Now, you will see that the Privacy Policy section is no longer greyed out. Depending on how you’ve set the global settings for all domains, you can flag the option to not require a policy signature for users in this subdomain (meaning that these users will not have to accept a privacy policy before accessing their platforms), or you can flag the Assign a policy option.
If you flag the second option, use the Select a policy dropdown menu to assign a privacy policy for this domain of your extended enterprise. Alternatively, you can assign a privacy policy to this subdomain from the Privacy Policy management area of your platform. The assigned policy will be reflected in the interface of the Privacy Policy tab in the subdomain’s settings. Likewise, if you assign a policy to the client in the settings area for the subdomain, it will be reflected in the interface of the Privacy Policy management area of your platform. Press Save Changes once finished.
Upon assigning a privacy policy to a subdomain, all users in that subdomain must accept that privacy policy upon their next log into the platform. Refer to this article to learn more about managing your privacy policy.
Terms and Conditions Tab
Whether you have activated the terms and conditions globally from your main domain or not, you can locally activate or deactivate terms and conditions for a subdomain in the Extended Enterprise settings. Remember that local settings take priority over the global configuration for the terms and conditions, so any settings that you configure for that subdomain will always override any global terms and conditions settings that you’ve configured.
In the Terms & Conditions tab, flag the option in the first section to Enable custom settings for this client. Now, you will see that the Terms & Conditions section is no longer greyed out. Depending on how you’ve set the global settings for all domains, you can flag the option to not require a policy signature for users in this subdomain (meaning that these users will not have to accept a privacy policy before accessing their platforms), or you can flag the Assign a Terms and Conditions record option.
If you flag the second option, use the dropdown menu to assign terms and conditions for this domain of your extended enterprise. Alternatively, you can assign terms and conditions to this subdomain from the Terms and Conditions management area of your platform. The assigned terms and conditions will be reflected in the interface of the Terms & Conditions tab in the subdomain’s settings. Likewise, if you assign terms and conditions to the client in the settings area for the subdomain, it will be reflected in the interface of the Terms & Conditions management area of your platform. Press Save Changes once finished.
Upon assigning terms & conditions to a subdomain, all users in that subdomain must accept those terms & conditions upon their next log into the platform. Refer to this article to learn more about managing your privacy policy.
Advanced Tab
In this tab, you can flag whether to activate the "send notification" option when Admins create new users. Upon creating the new user, the User has been created (by administrator) will be sent to the email address that you added for the user.
This notification must already be configured and activated using the Notifications app if you want to use this feature.
When finished, press Save Changes.
Teams and Managers Tab
For those using the My Team functionality in Docebo, you can apply specific settings to a client of your extended enterprise, overriding any global settings you have configured. Simply flag the option at the top of the tab to enable custom settings for the client, then configure the available options according to your needs. Refer to this article for further information on My Team settings.
Best practices
The Extended Enterprise app is recommended in the following use cases:
- Internal: You have business units in your company and you want to separate for users the login page to the platform (e. g. with their own language and look & feel). You need to delegate to some power users limited control over specific users.
- External: You sell courses to your clients and you want to provide them separated login page, domain and look & feel.
- Internal/External: A combination of the previous ones.
The Extended Enterprise app does not work in case:
- You want to partition the platform in instances and allocate an independent Superadmin per branch. Superadmin has always visibility on the whole platform configuration, contents, users.
Subfolder Restrictions for Extended Enterprise Clients
When creating subfolders for extended enterprise clients, you cannot create subfolders that start with or are labeled exactly as the following words:
- hybridauth
- doceboLms
- addons
- admin
- api
- authoring
- common
- gapps
- lms
- app7020
- mobile
- moxiemanager
- plugins
- custom_plugins
- tcapi
- themes
- sso
- oauth2
- pens
- webapp
- cookiebaker
- simplesaml
- offline.php
- check_*.php
- legacy
- learn/v1
- demo/v1
- manage/v1
- notifications/v1
- share/v1
- skill/v1
- docs/v1
- debug
- hydra-assets
- learn
- demo
- manage
- notifications
- share
- skill
- docs
- unauthorized
- public
- ecommerce/v1
- setup/v1
- salesforce/v1
- setup
- ecommerce
- salesforce