Single Sign-On
Single Sign-On (SSO) allows users to sign in to the portal with their organisation account, for example Microsoft Entra ID, Okta or Active Directory Federation Services, instead of a separate password. The portal supports OpenID Connect (OIDC).
Information exchanged during SSO setup
| The customer provides | EC provides |
|---|---|
| Identity provider discovery URL (issuer) | Portal redirect URI |
| Client ID | Portal sign-out URI |
| Client secret (sent through a secure channel) | List of required claims (for example email, name, groups) |
| Group or claim used to map roles | Portal roles to map the groups to |
Setup steps
- Register the portal as an application in the identity provider, using the redirect URI supplied by EC.
- Create a client secret and note the client ID.
- Add the claims EC requires, such as email, name and group membership.
- Send the values to EC through a secure channel. EC configures the portal.
- Test sign-in with a test user, then map identity-provider groups to portal roles.