Single sign-on with OAuth 2.0
Use your website's OAuth 2.0 provider to identify an operator and enter INSIDE through single sign-on.
What it is
Single Sign-On with OAuth 2.0 lets INSIDE identify you through a configured provider. INSIDE obtains your email address from the provider and uses it to find or create your operator account.
Powerfront configures the connection for your website.
Who uses it and why
Operators use the provider's sign-in process. Administrators choose the accounts that should use SSO. Developers and identity administrators supply provider details and work with Powerfront to test the integration.
Where to find it
Use Sign In with SSO on the configured sign-in page or follow the redirect during operator sign-in.
Powerfront manages Settings › Account › Single Sign-On, including SSO Type › OAuth 2.0. Users with the Settings role and operator permissions, or the Manager role with Edit Operator SSO, manage individual Single Sign-On selections under Settings › Account › Operators.
How it works
- INSIDE redirects you to the configured Authorization Endpoint.
- You complete the provider's authentication and authorisation steps.
- The provider returns an authorisation code.
- INSIDE exchanges the code using Token Endpoint, Client ID and Client Secret.
- INSIDE requests your identity through User Info URL and reads your email address.
- INSIDE resolves your operator account and applies local admission checks before opening the console.
Automatic account creation can handle an email address that does not yet have an INSIDE account, if Powerfront has configured it. The new account may need activation before access is granted.
Configure it
Ask Powerfront to enable Single Sign-On and choose OAuth 2.0. Supply your provider's authorisation, token and user-information details through the agreed configuration process. Powerfront also needs the registered Client ID, Client Secret and required Scopes.
The default scopes are openid, email and profile. Ask Powerfront to confirm that your provider returns a usable email address and supports the required return flow.
Powerfront can configure IP Ranges, Remote Logout URL and website-wide SSO enforcement. Enabling Enforce SSO for all Operators updates existing client accounts whose default website is this website. Review other accounts separately. An authorised account manager can set an individual exception afterwards; managers need Edit Operator SSO.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Enable | Settings › Account › Single Sign-On | website | Off | Powerfront | Enable the website's configured single sign-on method. |
| SSO Type | Settings › Account › Single Sign-On | website | SAML 2.0 | Powerfront | Select OAuth 2.0 to use the OAuth provider settings. |
| Authorization Endpoint | Settings › Account › Single Sign-On | website | Not set | Powerfront | Set the provider destination where operator authorisation begins. Not set prevents OAuth sign-in until a destination is supplied. |
| Token Endpoint | Settings › Account › Single Sign-On | website | Not set | Powerfront | Set the provider service used to exchange the returned authorisation code for a token. Not set prevents OAuth sign-in until an endpoint is supplied. |
| Client ID | Settings › Account › Single Sign-On | website | Not set | Powerfront | Identify the INSIDE integration registered with the provider. Not set prevents OAuth sign-in until an ID is supplied. |
| Client Secret | Settings › Account › Single Sign-On | website | Not set | Powerfront | Supply the provider credential used when exchanging an authorisation code. Not set prevents OAuth sign-in until a secret is supplied. |
| Scopes | Settings › Account › Single Sign-On | website | openid, email, profile | Powerfront | Choose the identity information requested from the provider. |
| User Info URL | Settings › Account › Single Sign-On | website | Not set | Powerfront | Set the provider service from which INSIDE reads the operator's email address and name. Not set prevents OAuth sign-in until a URL is supplied. |
| Remote Logout URL | Settings › Account › Single Sign-On | website | Not set | Powerfront | Redirect the operator to this destination after OAuth single sign-on logout. Not set means no remote logout redirect is configured. |
| IP Ranges | Settings › Account › Single Sign-On | website | Not set | Powerfront | Restrict single sign-on to the configured network addresses or ranges. Not set means no network restriction from this setting. |
| Enforce SSO for all Operators | Settings › Account › Single Sign-On | website | Off | Powerfront | Turning this on enables SSO on existing client operator accounts whose default website is this website; individual exceptions can be set afterwards. |
| Single Sign-On | Settings › Account › Operators | operator | Off | Settings role, Manager role | Direct this operator to the configured provider when website single sign-on is enabled. |
Permissions
| Permission | Lets you |
|---|---|
| Settings | Manage permitted operator accounts, subject to Settings Permissions. |
| Operators | Allow operator administration within Settings Permissions. |
| Manager | Manage permitted operator accounts, subject to Manager Permissions. |
| Edit Operator SSO | Allow a manager to change an operator's Single Sign-On selection. |
Limits and good to know
- Provider authentication does not bypass local account activation, website access or network restrictions.
- Missing provider settings prevent the OAuth flow from starting.
- An email address is required from the provider's user-information response.
- Single sign-on accounts are exempt from local INSIDE password expiry. Manage provider passwords with your identity provider.
- Browser, operator-app and manager-app sign-in use different return flows. Test the flows your organisation needs with Powerfront.
Depends on and works with
View all connections as a list
This feature uses
- Operator accountsConfigured by
Local operator activation and Single Sign-On selections still apply.
- Roles and permissionsConfigured by
Delegated permissions control operator SSO editing.
- Website, channel and subsite accessConfigured by
Existing operators retain their local website access restrictions.
- Login and email verificationRequires
Provider identity leads to INSIDE operator-account admission.
- Logout and remembered computersRelated
Provider sign-in opens an operator session, and logout follows the configured provider destination.
- SSO operator creation and activationEnhances
Automatic creation can create a missing provider identity as an INSIDE operator.
- Operator sign-in network and email restrictionsConfigured by
Network restrictions and new-operator email-domain policy can prevent access.
Used by
- Login and email verificationEnhances
OAuth single sign-on can direct an operator to an identity provider.
- Password changes and recoveryRelated
OAuth users manage their provider password separately and are exempt from local password expiry.
- Logout and remembered computersConfigured by
OAuth settings supply the remote logout destination when one is configured.
- SSO operator creation and activationConfigured by
For OAuth, website Single Sign-On settings select the creation template, notification and activation message.
- Operator sign-in network and email restrictionsConfigured by
OAuth sign-in also uses the SSO IP Ranges list.
FAQ and troubleshooting
Why does sign-in report that an endpoint or client setting is missing?
The website's OAuth configuration is incomplete. Ask Powerfront to check the named setting in Single Sign-On.
Why does INSIDE say no email was found?
The provider did not return identity information containing a usable email address. Your identity administrator and Powerfront need to check scopes and identity mapping.
Why am I asked to wait for activation?
INSIDE may have created your account from the configured template. An authorised account manager must activate it before you can enter.
Can our administrator edit the provider settings in INSIDE?
Powerfront manages the provider settings for you. Authorised client account managers can change individual operator SSO selections.
Why does a successful provider login still fail from my network?
Your website may restrict SSO to specific IP Ranges. Ask Powerfront to check the permitted networks.