Pre-Release Date: July 11, 2016 | Release Dates: July 29 & August 5, 2016
We are pleased to bring you Vault V15. Read about the new features below. You can find information on enabling new features in V15 Feature Enablement Details.
Vault Objects
Dynamic Access Control for Objects
In this release, Vault supports Dynamic Access Control (DAC) for object records. This security model works similarly to Dynamic Access Control for documents. It enables Admins to define security rules for controlling access to specific object records. Admins enable this security model on individual objects.
This new model uses the same roles on object records (Viewer, Editor,Owner) as Custom Sharing Rules (formerly called Dynamic Security). In the new model, Admins control user access by creating User Role Setup records and configuring Matching Sharing Rules on an object.
Learn more about this feature.
Bulk Actions for Objects
This enhancement streamlines object record management by enabling users to edit, delete, or change lifecycle state for up to 1,000 records at a time.
Similar to bulk actions for documents, users access the bulk option from the actions menu (represented by a gear icon) in an object record list page. Bulk actions use a wizard where users can refine record selection, choose an action, and confirm. Users receive notifications in Vault and via email when the process is complete.
Users must have a security profile that grants the Application: Object: Bulk Action permission to access this feature. Their security profile must also grant the necessary object-level permissions (Read, Edit, Delete). On objects that use Matching Sharing Rules or Custom Sharing Rules to secure individual records, users must be in the Editor or Owner role on an object record to edit or delete it.
Learn more about bulk actions for objects.
Object Types
In this release, an object can have “object types.” Each object type is a collection of fields that are grouped to capture similar data, but used across multiple business groups. For example, the Product object may include two types: Pharmaceutical Product and Medical Device Product. These two object types share some fields, but Pharmaceutical Product and Medical Device Product each have their own specific fields. Business groups can now not only manage data specific to their business in a more efficient manner, but can also easily report on records for one specific object type or all object types. Learn about setting up object types.
Entry Criteria for Object Lifecycle States
To provide more functionality for object lifecycles, Vault now supports entry criteria on lifecycle states. With this feature, records must meet defined requirements before they can enter a specific state. For example, a Marketing Campaign record could not enter In Review state if the Campaign Manager and Agency fields were blank.
Higher Limit for Object Page Layout Sections
When Admins edit object page layouts, they can now add up to 20 layout sections, an increase from the previous limit of 10. This change supports newer applications like RIM and QMS, which provide many more standard objects and a more complex structure of object relationships. Learn about configuring page layouts.
Minor UI Changes: Renaming Dynamic Security
“Dynamic Security” for object records is now called “Custom Sharing Rules.” This change supports the new Dynamic Access Control for Objects feature.
Search & Document View
Multi-Document Viewer for Binders
In this release, Vault has a new way to view and interact with multiple documents in a binder or binder section. The multi-document viewer provides a seamless and contextual way for users to view the collection of documents in any binder or section. This viewer also allows users to perform bulk actions on all documents in the binder, even if documents are in sections or sub-sections. Learn more.
Search Modifiers
Search modifiers allow you to quickly apply a document field filter from within the search bar, rather than searching for a value within all fields. Vault now suggests document field names as users type in their search terms. Once users select a field, they can:
(Text fields only) Type in a value and press enter to search for documents with the value within that field
(Picklist, object reference, yes/no, Document Number, Created By, and Last Modified By fields) Select a value from the list of suggestions, or type to narrow the list and then select a value
If users want to apply multiple filters, they can do so by returning to the search box. Like with filters in the sidebar, performing a standard or advanced search will clear any applied filters. This feature is not available for object tabs.
Filtering on Number Fields
Users can now filter on number fields in the Library, document tabs, and object tabs. Operators for number fields include “in the range” and “equals.” Learn more about filtering.
Document Archiving
Document archiving now lets organizations move obsolete or unused content to a supplemental search index. Once archived, documents are excluded from search results unless users specify that they want to search the archives.
Any user with permission to manage the archives can move documents in and out of the archives using Vault Loader or the API. Users with permission to manage archives also have access to the Archive tab where they can easily navigate all archived documents.
Learn more about document archiving.
Searchable Object Fields Administration Includes Object Filters
The Admin > Configuration > Searchable Object Fields setup now also controls whether an object field is available as a document filter.
For example, Therapeutic Area may be valuable information when looking for documents that reference products, while the Status field on Product is not. If Product: Therapeutic Area is a searchable field, but Product: Status is not, users would see Therapeutic Area in their document tab filters, but not Status.
Learn more about searchable object fields administration.
Binder Export Support for Attachments
Study sponsors, CROs, and other key stakeholders often need to provide more information about documents in a publishing or handover phase. To provide a more complete view of the binder and its contents, Vault now allows users to include document attachments in their binder export file. When exporting, they can choose to include all versions of attachments, or only the latest versions. Learn more about binder export.
Reporting
Cross-Version Reporting
Cross-Version Reporting enables users to create reports that include all versions of documents. Users can turn this option on for any reports with the Document or [Object] with Document report types by selecting a checkbox during report creation.
Cross-version reports display:
Rows for each version: A separate row for each major and minor version that fits the report’s filters and that the user can access
Version field: A sortable and filterable column that combines the major and minor version numbers (0.1, 0.2, 1.0, etc.)
State Type field: A filterable field that shows the special state (Steady, Superseded, etc.) for each document version
Steady State Begin and Steady State End fields: Filterable fields indicating the first and last date on which a document version was in the Steady state
The feature is particularly helpful for supporting audits. To generate a list of documents that were in Steady state during a specified window of time, users simply apply date-based filters to the new Steady State Begin and Steady State End fields. The report viewer not only displays details about prior document versions but also enables the user to drill into each one for more information.
Learn more about cross-version reporting.
Conditional Report Fields for Document & Object Reports
Vault first introduced Conditional Fields in V14 for Document Relationship report types. In V15, we are extending them to Document and Object report types. Report creators can use this feature to apply a label to each report row based on a series of conditions.
For example, a user could group a report by Document Status with a conditional field that shows a category labeled “In Progress” for Draft and In Review documents and another labeled “Approved” for documents in Approved, Approved for Use, etc. states.
Once defined, users can group by the new conditional fields.
Matrix Layout for Additional Report Types
Document reports have supported matrix layouts for several releases. In this release, Vault extends matrix layouts to several additional report types: Document Relationship, Object, and Binder. Matrix layout requires that users group records by two parameters: a row grouping and a column grouping. The report displays aggregate values (record count, sum, average, etc.) at the intersection of each row-column combination.
Aggregate values can also appear as a percentage of the total row or column value. For clinical users, this setup makes it easy to quickly assess the share of documents that are complete by country, site, document type, or other relevant parameters. Similarly, commercial customers can leverage this to assess the percent of content that’s reused by a combination of any two attributes (document type, agency, local country, month, etc.).
Percentage of Total Calculation in Reports
Tabular reports and select dashboard charts now support percentage display formats. Displaying as percentages makes it easier to compare relative sizes of groups with widely different absolute values. For example, customers may show the percentage of documents that are approved or not within each document type. Even if the absolute number of documents for each type varies significantly, the proportion that are approved is simpler to understand on a consistent scale of 0 to 100.
In tabular reports:
First-level groups display percent values as the portion of the total record count for the report.
Percent values in second-level groups represent their portion of the parent group.
In dashboards:
Bar and column charts include new percentage display options for stacked bars/columns. This renders each bar/column as the same height/width (100%). The relative size of each subgroup determines the size of that portion of the stack, allowing users an easier visual comparison.
Number charts that display a single large and important number can now represent the percentage of a particular group within a larger total.
Renditions & Annotations
Restore Placement for Bring Forward Annotations
Bringing annotations forward from a previous version results in page-level annotations, without a text or image selection. As a result, users may spend hours restoring annotation placement in the latest version. In this release, Vault can auto-place text annotations when the matching text is found only once on the same page by number. Vault also allows users to declare when pages have been added or removed in the new version, ensuring more accurate placement of annotations brought forward from past versions.
Fully Annotatable PowerPoint Slides with Speaker Notes
This release introduces the new PowerPoint Rendition Settings action for documents with a PowerPoint source file. Using this option, users can choose whether they want to include Speaker Notes and hidden slides in the Viewable Rendition.
Learn more about viewable renditions.
Generate Bookmarks from Table of Contents
Admins can now enable Generate bookmarks based on Table of Contents to ensure that new viewable renditions from MS Word files will include bookmarks based on the links in the Table of Contents. For MS Word source files that don’t include a Table of Contents, Vault dynamically creates bookmarks based on Headings 1 through 9.
This setting only affects renditions generated after enabling the setting. Vault will not regenerate existing viewable renditions to reflect the new setting.
Learn about bookmark support.
Word Rendition Settings: Markup
In this release, Vault users will see the new Word Rendition Settings in the document actions menu when their source file is a MS Word document. Using this option, users can choose whether to show or hide markup from the source file in the Viewable Rendition. The Manage Viewable Rendition document role permission controls access to this action.
PDF Rendition Settings: Show/Hide Print Only Watermark
In this release, users will see PDF Rendition Settings in the document actions menu when their source file is a PDF. This action enables users to choose whether the viewable rendition shows or hides “Print Only” watermarks from the source file.
Learn more about viewable renditions.
Next and Previous Navigation for Annotation Notes
With this enhancement, users in Annotate mode with the Sidebar note position can navigate between annotation notes using the up (previous) and down (next) arrow buttons in the viewer toolbar or using keyboard shortcuts: S for next and W for previous.
Expected Document Lists
EDL Available in All Applications
With this release, Expected Document Lists (EDLs) are available in all Vault applications. EDLs help organizations measure the completeness of projects by tracking the number of documents that meet specified criteria within EDL Item object records and comparing the count to an expected target.
Match Now Action for EDL Items
Expected Document Lists (EDLs) help organizations to measure the completeness of projects like clinical studies. This enhancement improves the process for managing EDLs by providing users with an action that updates the matched documents for a specific EDL item. Previously, Vault only matched documents via a daily batch matching job. Now, users can manually trigger matching to update the EDL Item Completeness and Document Count. This new ability is particularly helpful when users have submitted documents just before an important meeting or deadline.
EDL Matches on Planned Documents
In the initial release of EDL, the matching job did not recognize Planned state documents. However, users need these documents included to avoid creating duplicate Planned state placeholders. In this release, the All Document Count field includes planned documents.
View Related EDL Items
In V14, Vault allowed a user to navigate to a single Expected Document List Item for a site, edit the item, and then quickly update all related items for all sites in a study or all sites in a study country. In V15, we’ve made it easier for users to change multiple Expected Document List Items when the scope is narrower than “all sites,” for example, only sites in a study that are currently enrolling. The new View Related action on Expected Document List Items navigates users to a filtered list of related items. From there, users filter to narrow the list and use bulk actions to make the required updates. Learn more.
Workflow Configuration
Workflow on Objects
To enable organizations to automate their business process around objects, Vault now supports workflows on objects. With this release, Admins can configure workflows that send notifications, move records into new lifecycle states, send tasks to users, and make decisions based on record field values and task verdicts.
For example, a simple approval workflow can change the state of the record to In Approval, then send a task to one or more approvers. The approvers complete their tasks by filling in record fields, providing a verdict, and selecting a reason for their decision. Once all tasks are complete, Vault automatically decides whether to change the state of the record to Approved or revert to the previous state.
Participants in an object workflow see a task bar in the record detail page if they have a task. A new Workflow Timeline area on record detail page displays a detailed history of workflows and tasks. Vault also allows users to start workflows and complete tasks via API, enabling external integrations.
Learn more about setting up and using object workflows.
Automatic Task Reminders
Today, workflow owners may have several documents or object records in review at a time and it can be time-consuming to follow up with users who haven’t completed tasks. This release introduces automatic task reminders to save that manual effort and keep workflows moving forward. With this feature, Admins can configure workflow user tasks with automatic reminders, so users receive notifications that they have open tasks to complete. When defining these reminders, Admins specify:
Date when Vault sends reminders, in relation to the Workflow Due Date or Task Creation Date
Message template for each reminder
Which roles (of those specified in the workflow start dialog) should receive reminders
Learn about setting up reminders for document workflows or object workflows.
eSignature on Object Workflows
Admins can now configure object workflows to include electronic signatures prompts on task completion or on verdict selection. When users provide an eSignature, Vault asks them to re-enter their login username and password to verify their identity. Learn about configuring object workflows.
Document Configuration
Object Attribute Lookup Fields for Documents
In this release, we’ve introduced the new Lookup field type for documents. This field “looks up” an attribute on an object record already associated with a document and brings that value down to the document as a read-only field. Lookup fields can support search, filtering, and reporting. They can also provide additional context for Dynamic Access Control on documents.
Preview for Advanced Overlays
In this release, advanced overlay template management has become even easier. An Admin can now view what a document will look like given a specific page size in both page orientations. Vault applies the best-fit match overlay per page of an example document and renders the document for review. Vault also offers a preview option for the base overlay.
Original Source Relationship for Copies
Organizations that frequently leverage existing content by copying sometimes have trouble tracking how often a specific document is reused. With this enhancement, users can identify the original document for a derivative that was created via multiple copies.
Vault achieves this using a new, system-managed relationship type: Original Source. This relationship points to the original document. This feature also introduces the new Copy Depth standard field, which tracks how many copies a document is from the original.
Using reporting in conjunction with this feature more accurately tracks reuse for a specific document.
Support for Multiple Document Type Groups
Admins can now assign multiple document type groups to Base Document, document types, subtypes, and classifications. This update helps support DAC for documents. With this change, organizations can define and manage both granular and coarse document type security policies, based on specific country and regulatory requirements.
For example, VeePharm assigns a document type group to all classifications associated with the Advertisement subtype and assigns more granular document type groups at each classification level (print, radio, web, television).
Admins can reference these document type groups in User Role Setup records, giving the flexibility to define access based on different groups of document types, subtypes, and classifications. In our example, a Marketing Manager role could access all documents in the “Advertisement” document type group, while a Web Marketer could access only documents assigned to the “Web” document type group.
Learn more about document type groups.
ISO 8601 Date & Time Format Support
Administrators can now set the ISO 8601 date format (YYYY-MM-DD) as their universal display format throughout Vault. ISO 8601 describes an internationally accepted way to represent dates and times using numbers..
ISO 8601 provides a standardized way of presenting dates and times. It helps cut out the uncertainty and confusion when communicating internationally.
Learn more about ISO 8601 support.
Permission Set Control for Creating Unclassified Documents
In previous releases, access to the Upload button was controlled by users’ permissions to create documents via document type configuration. This setup causes problems for some customers, as their business process requires a designated group of users to classify documents, while another group only uploads files.
Examples include:
CRO/Sponsor working in one vault: Sponsors may not want CROs to classify documents in their vault, as they have their own TMF filing structure.
CRA resourcing: CROs mandate that CRAs be on the road 90% of the time and prioritize on-site time. In this business process, organizations want to minimize the CRAs’ administrative duties: CRAs bulk upload files to unclassified documents and allow an in-house CRA to classify on their behalf.
Sponsors with site users: Sponsors often want site users to upload files to Vault, without classifying documents.
Decreased Limit for Document DAC Rules
As an implementation best practice, and to ensure optimal performance, we recommend using as few matching rules as possible per document lifecycle role.
Starting from this release, the maximum number of matching rules per lifecycle role is now 8 (originally 25). If your vault already uses more than 8 rules per role, your current number becomes the new maximum on your vault.
Learn more about DAC for documents.
eTMF & Study Startup
Site Activation Progress View
The critical path for site activation requires collecting site documents quickly, finalizing contracts and budgets, and ensuring local approvals are complete. Site Activation Progress is a new view allowing study startup specialists to monitor overall progress across a study country and easily identify what is holding up each site’s greenlight. Status indicator icons and hover cards provide detail at a glance. Startup specialists can also navigate directly to documents to remind the site to submit or take other immediate action, enabling them to get every site to first subject, first visit faster.
Learn about setting up the Site Activation Progress view.
TMF Viewer
The TMF Viewer enables customers to actively manage their TMF by enabling them to browse content organized by multiple configured hierarchies. Admins can configure multiple binder templates to represent hierarchical structures, for example, TMF Reference Model 2.0, 3.0, or a completely custom structure.
Using the TMF Viewer, users select a binder template—Study, Study Country and/or Study Site—and then browse content organized by the binder template’s filing rules. Users can easily switch between different hierarchy views. As document types and reference model standards evolve over time, administrators can create new binder templates and make them available through the TMF Viewer. Note that binders using the Binder Section to Document Type filing model are not available in the TMF Viewer.
Learn more about TMF Viewer.
Bulk Create Binders for a Study
Archiving a TMF in Vault requires creation of a “master file” binder for the study and for each of the study’s countries and sites. In this release, users can trigger bulk creation of master file binders for an entire study or an entire study country, directly from the relevant study or study country page. After binder creation is complete, Vault initiates the auto-filing process on the new binder, so that a complete set of master file binders is ready for review and archival. Note that auto-filing does not initiate after creation if the filing model is Binder Section to Document Type.
Learn more about bulk binder creation.
Study Team Assignments
This new eTMF feature enables study team leaders to more easily administer Vault security by assigning users to role(s) for a specific study and scope (study countries and sites). Using Study Team Assignments lets an organization leverage the flexibility of Dynamic Access Control for documents without having to manually create many User Role Setup records for the same user. This feature automates the creation of User Role Setup records according to your business rules. Using this feature, Study or Country Managers easily maintain their own team rosters, supporting quicker and easier upkeep of vault document security. Learn more.
This feature requires that your vault has Dynamic Access Control enabled for documents.
Lifecycle & Workflow on Milestone Object
In past releases, Admins could not edit the standard Milestone object in eTMF in order to apply an object lifecycle. We’ve updated eTMF vaults to allow this action, so customers can track study progress in an efficient and accurate way.
Multichannel
Email Template Editor for Approved Email
In this release, users are able to create and update responsive HTML files for Email Template documents from within Vault. This feature leverages the MailUp’s BEE email editor to provide Vault users with a quick and easy way to manage HTML email templates.
Note that this feature will not be available until the CRM V27 release on July 22nd. Learn about the email editor.
Create Presentation Supports Slide Versioning
Create Presentation better handles content updates. When a user triggers Create Presentation on a document that already has a Multichannel Presentation and Multichannel Slides, that user can now choose to version the existing slides. In past releases, this action always created new slides. Note that the version option only appears if the viewable rendition page counts match between the two versions.
Slide Name & Title Auto-Fill from PPTX
This feature provides more seamless management for Multichannel content by enhancing the Create Presentation action: when users split the pages of a source document into separate slides, they can now choose to auto-fill the Name and Title fields on each slide with the page title from the corresponding PowerPoint slide.
Minor Enhancements for CLM Integration & Approved Email
For customers using Approved Email and CLM integrations, we’ve added new configurations to support enhancements coming to Veeva CRM in V27. These changes are visible starting in this release, but won’t be functional until the Veeva CRM V27 release.
For vaults with Approved Email Integration, we will provision the new Survey object and document field. This configuration, which already exists for CLM, supports survey functionality in Approved Email.
For vaults with CLM Integration, we will provision the new Keywords object and field. This configuration supports classifying CLM in Vault and Veeva CRM.
Form 2253 Generation
Multi-Product 2253 Generation
Vault PromoMats can now auto-generate the Supplementary Sheet required for multi-product 2253 submissions. To support this, we’ve added a new standard Application object, which stores the Application Number and Application Type (previously fields on the binder). Each Application is associated with a Product and Applicant object. Selecting a product when creating a 2253 Compliance Package binder, automatically selects both the Application and Applicant and populates the FDA Form 2253 and Supplementary Sheet accordingly.
This release also splits out Responsible Official details from the existing Applicant object, allowing the 2253 administrator to select the appropriate Responsible Official per submission. These details are now stored in a new Contact object.
Note: A feature flag controls the new standard Application and Contact objects, but remapping the FDA Form 2253 requires configuration by Managed Services on existing vaults.
Learn more about multi-product 2253 generation.
Improved Handling for Form 2253 Generation
For any Form 2253 generated after this release, Vault automatically populates the hidden External ID field. The auto-populated value identifies the form as system-generated so that Vault knows to version the document. If the compliance binder contains a manually uploaded Form 2253, Vault will not version the form, and will instead generate a new form. In past versions, Vault would version the form regardless of whether it was system-generated or manually uploaded.
Note that Vault considers any Form 2253 created before this release to be a manual upload because its External ID field does not contain the system-generated value. When generating Form 2253 documents in this situation, users will notice that their binder contains two Form 2253 documents.
Learn more about generating Form 2253.
RIM
RIM Data Model Updates
With this release, all applications in the RIM suite will receive new object definitions. Some of these changes are in response to customer feedback, while others continue to move Vault closer to full IDMP coverage. Learn more.
Export for Archived Submissions
With this release, users can asynchronously export the Submissions Archive dossier per submission. Users can navigate the eCTD structure to select the components for export or navigate the non-eCTD folder structure. The export maintains the same folder structure used at the time of import, allowing users to quickly leverage these submissions or components for other regions.
Improved Bulk Record Creation & Impact Assessment Report Action
Based on feedback from early customers, Veeva identified some ways to improve usability for RIM Registrations context-specific actions introduced in V14. These changes better meet the needs of our regulatory users and provide a more streamlined process:
Any custom required fields now display on the bulk creation wizard for both Activity and Submission objects.
During bulk Submission creation, Vault automatically creates the relationship between the submission and the pharmaceutical (drug) product. This relationship is leveraged in the bulk Registrations creation.
During bulk creation of Registration records, Vault prompts users for fewer fields. We’ve also leveraged the registrations lifecycle, rather than the Status picklist when users bulk create registrations.
Opening the Impact Assessment Report from an event record now opens in the same window, rather than a new tab. The report also displays new columns by default: Application Name and Related Shelf Life.
Learn more about bulk record creation for RIM.
SubmissionsArchive Cancellation Option
In this release, SubmissionsArchive users can cancel import or removal jobs that are in waiting to be processed or in-progress. These options give users the ability to quickly react to errors encountered during the import of submissions or the migration of multi-sequence applications.
New Applications and Submissions Document Fields
With this release, RIM vaults will include two new standard shared document fields: Applications (applications__v) and Submissions (submissions__v). SubmissionsArchive can auto-populate these document fields based on submission imports. These additional fields are valuable for document searches and support more granular Dynamic Access Control rules on documents.
Expand & Collapse in SubmissionsArchive Viewer
This enhancement provides users with an improved experience by minimizing the number of clicks needed to reach content in an archive. Previously, users needed to drill down by individual section to reach sections with content. With this enhancement, a single click on the Expand Section action menu item on the binder section opens all sub-sections until a section with content is reached. Similarly, the Collapse action menu item collapses all sections with a single click.
Final Dossier Available from Application or Submission Records
With this release, users can easily jump to the final dossier in the Viewer tab from the actions menu on an individual Application or Submission object record.
Additional eCTD DTD/Schema Support
SubmissionsArchive users can now import additional DTDs/schemas:
CA 1.0
CA 2.2
CH 1.01
CH 1.1
CH 1.2
CH 1.3
EU 1.0
EU 1.3
EU 3.0.1
Learn more about supported DTDs/schemas.
Minor UI Changes: Remove “Archive”
The term “archive” has been removed from several places in the RIM applications to prevent confusion.
Performance & Monitoring
Vault Performance Stats
Vault Administrators will now be able to see certain performance statistics associated with their vaults, for example, average login times, on a day-by-day basis using a new standard object. Vault automatically creates a record every day and populates the record fields with the performance statistics. Learn more.
Vault Loader Enhanced Logging
Vault Loader success and failure logs are now combined so you can easily map successes and failures to your original input file.
Learn more about Vault Loader.
Distributed File System (DFS)
DFS is an infrastructure enhancement that enables Vault to automatically expand storage capacity as organizations add larger volumes of files to their vaults. DFS not impact Vault functionality, is transparent to end-users, and does not change the validation of your application. With DFS, Vault applications will now use Amazon Web Services (“AWS”) for file storage. Remote files are encrypted and all data processing by AWS will remain in the same region as the current datacenter for your Vault environment. Enablement of DFS is performed in phases by POD. You will be contacted by your Veeva Customer Success Manager before the feature is enabled for your vault.
Authentication
SSO: Configurable RelayState on IdP-Initiated URLs
With this release, Single Sign-On SAML profiles allow greater configurability of IdP-initiated URLs, providing for more flexibility for deep-linking with various Identity Providers. Specifically, Admins can use a new templating syntax to define the required URL query parameters and ensure proper value encodings.
Learn more about deep-linking with SSO.
SAML SSO SHA-256
This release includes support for SHA-256 as hash algorithm for generating and validating SAML signatures. To enable SHA-256 as a signing algorithm on SP-initiated SAML requests, an Admin should update the SAML Single Sign-on Profile by changing the “Signature and Digest Algorithm” setting to “SHA-256.” Support for the SHA-256 algorithm validating SAML responses from the IdP is automatic.