# Single sign-on with OAuth 2.0

Use your website's OAuth 2.0 provider to identify an operator and enter INSIDE through single sign-on.

*Release 3.3 · admin, developer, operator*

**Settings › Account › Single Sign-On** · **Settings › Account › Operators**

## What it is

**Single Sign-On** with **OAuth 2.0** lets INSIDE identify you through a configured provider. INSIDE obtains your email address from the provider and uses it to find or create your operator account.

Powerfront configures the connection for your website.

## Who uses it and why

Operators use the provider's sign-in process. Administrators choose the accounts that should use SSO. Developers and identity administrators supply provider details and work with Powerfront to test the integration.

## Where to find it

Use **Sign In with SSO** on the configured sign-in page or follow the redirect during operator sign-in.

Powerfront manages **Settings › Account › Single Sign-On**, including **SSO Type › OAuth 2.0**. Users with the **Settings** role and operator permissions, or the **Manager** role with **Edit Operator SSO**, manage individual **Single Sign-On** selections under **Settings › Account › Operators**.

## How it works

1. INSIDE redirects you to the configured **Authorization Endpoint**.
2. You complete the provider's authentication and authorisation steps.
3. The provider returns an authorisation code.
4. INSIDE exchanges the code using **Token Endpoint**, **Client ID** and **Client Secret**.
5. INSIDE requests your identity through **User Info URL** and reads your email address.
6. INSIDE resolves your operator account and applies local admission checks before opening the console.

Automatic account creation can handle an email address that does not yet have an INSIDE account, if Powerfront has configured it. The new account may need activation before access is granted.

## Configure it

Ask Powerfront to enable **Single Sign-On** and choose **OAuth 2.0**. Supply your provider's authorisation, token and user-information details through the agreed configuration process. Powerfront also needs the registered **Client ID**, **Client Secret** and required **Scopes**.

The default scopes are openid, email and profile. Ask Powerfront to confirm that your provider returns a usable email address and supports the required return flow.

Powerfront can configure **IP Ranges**, **Remote Logout URL** and website-wide SSO enforcement. Enabling **Enforce SSO for all Operators** updates existing client accounts whose default website is this website. Review other accounts separately. An authorised account manager can set an individual exception afterwards; managers need **Edit Operator SSO**.

### Settings

| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Enable | Settings › Account › Single Sign-On | website | Off | Powerfront, on request | Enable the website's configured single sign-on method. |
| SSO Type | Settings › Account › Single Sign-On | website | SAML 2.0 | Powerfront, on request | Select OAuth 2.0 to use the OAuth provider settings. |
| Authorization Endpoint | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Set the provider destination where operator authorisation begins. Not set prevents OAuth sign-in until a destination is supplied. |
| Token Endpoint | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Set the provider service used to exchange the returned authorisation code for a token. Not set prevents OAuth sign-in until an endpoint is supplied. |
| Client ID | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Identify the INSIDE integration registered with the provider. Not set prevents OAuth sign-in until an ID is supplied. |
| Client Secret | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Supply the provider credential used when exchanging an authorisation code. Not set prevents OAuth sign-in until a secret is supplied. |
| Scopes | Settings › Account › Single Sign-On | website | openid, email, profile | Powerfront, on request | Choose the identity information requested from the provider. |
| User Info URL | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Set the provider service from which INSIDE reads the operator's email address and name. Not set prevents OAuth sign-in until a URL is supplied. |
| Remote Logout URL | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Redirect the operator to this destination after OAuth single sign-on logout. Not set means no remote logout redirect is configured. |
| IP Ranges | Settings › Account › Single Sign-On | website | Not set | Powerfront, on request | Restrict single sign-on to the configured network addresses or ranges. Not set means no network restriction from this setting. |
| Enforce SSO for all Operators | Settings › Account › Single Sign-On | website | Off | Powerfront, on request | Turning this on enables SSO on existing client operator accounts whose default website is this website; individual exceptions can be set afterwards. |
| Single Sign-On | Settings › Account › Operators | operator | Off | Settings role, Manager role | Direct this operator to the configured provider when website single sign-on is enabled. |

### Permissions

| Permission | Lets you |
|---|---|
| Settings | Manage permitted operator accounts, subject to Settings Permissions. |
| Operators | Allow operator administration within Settings Permissions. |
| Manager | Manage permitted operator accounts, subject to Manager Permissions. |
| Edit Operator SSO | Allow a manager to change an operator's Single Sign-On selection. |

## Limits and good to know

- Provider authentication does not bypass local account activation, website access or network restrictions.
- Missing provider settings prevent the OAuth flow from starting.
- An email address is required from the provider's user-information response.
- Single sign-on accounts are exempt from local INSIDE password expiry. Manage provider passwords with your identity provider.
- Browser, operator-app and manager-app sign-in use different return flows. Test the flows your organisation needs with Powerfront.

## Depends on and works with

### This feature uses

- **Requires** [Login and email verification](SEC-001.md): Provider identity leads to INSIDE operator-account admission.
- **Configured in** [Operator accounts](ADM-007.md): Local operator activation and Single Sign-On selections still apply.
- **Configured in** [Roles and permissions](ADM-008.md): Delegated permissions control operator SSO editing.
- **Configured in** [Website, channel and subsite access](ADM-009.md): Existing operators retain their local website access restrictions.
- **Configured in** [Operator sign-in network and email restrictions](SEC-028.md): Network restrictions and new-operator email-domain policy can prevent access.
- **Works better with** [SSO operator creation and activation](SEC-007.md): Automatic creation can create a missing provider identity as an INSIDE operator.
- **Related** [Logout and remembered computers](SEC-004.md): Provider sign-in opens an operator session, and logout follows the configured provider destination.

### Used by

- **Configures** [Logout and remembered computers](SEC-004.md): OAuth settings supply the remote logout destination when one is configured.
- **Configures** [SSO operator creation and activation](SEC-007.md): For OAuth, website Single Sign-On settings select the creation template, notification and activation message.
- **Configures** [Operator sign-in network and email restrictions](SEC-028.md): OAuth sign-in also uses the SSO IP Ranges list.
- **Enhances** [Login and email verification](SEC-001.md): OAuth single sign-on can direct an operator to an identity provider.
- **Related** [Password changes and recovery](SEC-002.md): OAuth users manage their provider password separately and are exempt from local password expiry.

## FAQ and troubleshooting

### Why does sign-in report that an endpoint or client setting is missing?

The website's OAuth configuration is incomplete. Ask Powerfront to check the named setting in **Single Sign-On**.

### Why does INSIDE say no email was found?

The provider did not return identity information containing a usable email address. Your identity administrator and Powerfront need to check scopes and identity mapping.

### Why am I asked to wait for activation?

INSIDE may have created your account from the configured template. An authorised account manager must activate it before you can enter.

### Can our administrator edit the provider settings in INSIDE?

Powerfront manages the provider settings for you. Authorised client account managers can change individual operator SSO selections.

### Why does a successful provider login still fail from my network?

Your website may restrict SSO to specific **IP Ranges**. Ask Powerfront to check the permitted networks.