Feature Request

Allow for multiple SSO endpoints. This would allow all of our individual clients to attach their ADs so their employee access would be enabled and removed through their own rights management process.

Its odd to me i don't have a way to promote a user from a reader to a team member (and the reverse). As of now, it appears my only option is to delete the reader account and re-issue as a team member. Would it be possible to just have all user accounts in a single bucket with the ability to select their rights (and toggle them as the role of the user changes)?

Document360 should allow SSO integration with AD groups and users so that users don't have to login each time with user name & password -Requested by Mudbay

Currently, when readers are imported to Doc360, the only fields to fill in are email (required) and optionally name and surname. This doesn't allow to specify the groups reader should belong to, and when adding multiple readers one has to amend the reader groups for each reader by hand. It would be great if it was possible to add a list of groups on the import stage.

Our company has a mixed environment for our versions. One area is public, while all of the other versions are Private or behind a login. We have noticed that when a user is logged in and in particular, when they are viewing content in a Private version, the session seems to time out after ~10 minutes of inactivity. We notice this because when you leave an article open and then click on any links within the same section, the user gets a 404 error displayed. There is no message stating that the session has expired or that the user needs to login. They simply get a 404 error which makes them think that the website is broken. The only way to work-around this issue is for the user to click on the company logo to return to the homepage so they can login (again) and they have to manually navigate back to the content they want to access. This is not only an annoyance and an inconvenience, but most users that don't have PC or computer knowledge just won't use the website because they think it's broken. This needs to be resolved as soon as possible. Here are items that are needed from Docu360 development: 1 - We need a session time limit setting My company needs to control the session timeout - not document360. The needs of every company is different. If we were posting more secure content, we would likely want the current time setting - however our users need to access content all throughout their 8-hour workday so it makes more sense for us to have something more like an 8 or 12 hour timeout. I am sure we are not alone in this need. 2 - If the user's session has timed out - Document360 should re-direct the user to a page that states, "Your session has timed out - please login again" (and provide a link to do so). After the user logs in, they should be directed to whatever link / article they were attempting to originally click on when they timed out. A 404 error page is NOT acceptable - Users do not understand this page and they think the website is broken (which it is). I have documented how this issue is disruptive to the user experience and how it can make a novice user think the entire website is broken here is a video I've recorded showing and explaining the problem very clearly: https://www.dropbox.com/s/v5sahkbaksl88o6/TIMEOUT%20-%20404.mp4?dl=0

Currently there is no way to add HSTS (Strict-Transport-Security) and CSP(Content Security Policy) in to the list of http headers. Clients who use tools to measure network security score will benefit from these new headers.

JWT for readers and OpenID/SAML for team’s account. Ticket # 133627

We would like to be able to restrict access to a category so that it and all its subcategories and articles are only accessible by a group of internal users. Right now I cannot go to a category and set the permissions on it to, for example, only the "IT Team". Helpjuice and knowledgeowl can do this and it seems like pretty basic permissions functionality to be missing. I liken this to setting folder permissions in Windows which without would be a nightmare.

Be able to sort list of readers and reader groups by each category.

Modern Web applications can protect from XSS attacks by adding a CSP header. this header allows to define client side code execution security policy that is stronger than a generic X-XSS-PROTECTION header. Our customers demand that portals under our domains (such as Document360) will be protected with CSP headers. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP