We have created a Qualtrics survey which needs to be filled out by all of our employees so we are using a contact list generated from our internal Active Directory. The SSO Authenticator tool forces login and looks up the user through an LDAP lookup in the tool.

When a user receives a personal link to the survey they are forced to login, as expected, capturing the embedded data fields such as their name and email from AD. The problem is if the user does not complete the survey, and clicks the personal link at a later date, the survey logs them in without authenticating using the form username/password page. Worse, if another user gets access to this personal link somehow, they are logged into the original user's survey (no LDAP lookup to check for authentication).

This form is to capture sensitive, personal information and we cannot assume a link in an email will never be seen or mistakenly shared so we require that the survey user is ALWAYS authenticated.

How can we achieve this?