---
locale: "en"
updated_at: "2025-10-27T13:59:55.908Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/sso/install-backup-sso-server"
---

# Install a backup SSO server

Install and configure service, check and troubleshoot, best practices.

## Overview

UserLock Single Sign-On (SSO) provides secure and seamless authentication for web and cloud applications.

By deploying a backup SSO server, you **ensure service continuity** if the main SSO service becomes unavailable.

The backup server hosts a synchronized copy of your SSO configuration. If the main SSO service goes down, you can update the DNS record of your SSO URL to point to the backup server and **restore access for users**.

##### Key benefits

- Maintain SSO availability in case of outage or maintenance.
- Keep configuration and certificates automatically synchronized.
- Easily restore access through DNS redirection.

## Prerequisites

Before installation, verify that:

- The backup server meets the same [SSO service requirements](/userlock/docs/guides/sso/install-configure-sso#requirements).
- You install it on a **separate machine** from the main SSO server and, if possible, from the UserLock server itself.
- Both SSO services must run the **same version**.
- You have administrative rights on both machines.

> **Note**
>
> The backup SSO server does not communicate directly with the main one.
> Synchronization is managed through the UserLock server that hosts the SSO configuration.

## Step 1. Install the UserLock SSO feature

On a **new, distinct server** from your main SSO and UserLock servers:

1. Run the **UserLock installer**.
2. Choose **Custom installation**.
3. Select the **UserLock SSO** feature.
4. Unselect other features you do not need.
  ![](https://a.storyblok.com/f/122374/495x376/4cef438977/install-shield-userlock-sso-en.png)
5. Complete the installation wizard.

Once installed, the configuration wizard will allow you to register this instance as a backup SSO service.

## Step 2. Configure the backup SSO service

1. Open the **UserLock configuration wizard**.
2. In the **Single Sign-On** card, click **Modify**.
  ![](https://a.storyblok.com/f/122374/957x668/b793ea4edd/config-wizard-sso-modify.png)
3. The **main UserLock server** is automatically detected if an SSO service is already configured in your environment.
4. Confirm that:
  - The **left panel** displays the **main SSO server** information.
  - The **right panel** is selected:
  ![](https://a.storyblok.com/f/122374/968x653/7cbb3db5ec/sso-backup-not-configured.png)
5. Click **Configure backup service** on the right.
6. Complete the wizard (the SSO URL is automatically added to your intranet zone).

🎉 **The backup SSO server is now ready.** 
It automatically synchronizes configuration data from the main SSO service.

## Checking the configuration

You can now verify that the backup service is properly running and synchronized.

1. On the **backup server**, you can check its current status. From this interface, you can:
  - deactivate the backup service if necessary
  - view other configured backup servers
    ![](https://a.storyblok.com/f/122374/961x643/0aba7c1dd5/sso-backup-configured.png)
2. On the **main SSO server**, all backup servers are listed in the **Backup services** section. You can have **multiple backup servers**, all synchronized automatically.
  ![](https://a.storyblok.com/f/122374/947x619/f130bcba9a/sso-with-backup-servers.png)

## Best practices

- **Use a distinct host:** Install the backup on a separate machine to prevent single points of failure.
- **Plan DNS management:** Prepare how you will update your DNS.
- **Keep versions aligned:** All SSO servers must run the same UserLock version.
- **Test regularly:** Simulate a DNS switch to verify that the backup server works correctly.
- **Monitor synchronization:** Check periodically that the configuration status is **Configured **on both ends.

## Troubleshooting

If the **main SSO service becomes unavailable**, users may no longer be able to authenticate until the service is restored or redirected.

To maintain SSO access during downtime:

1. **Update your DNS records** to point the SSO URL to the backup SSO server.
This ensures that authentication requests are redirected to the backup instance.
2. Once the primary server is back online, you can **restore the DNS entry** to its original address.

For detailed recovery procedures, see the 👉 [SSO troubleshooting and recovery guide](/userlock/docs/support/troubleshooting/sso-issues).