Setting Up SSO in MSPCFO
Article: Set Up SSO in MSPCFO
These steps are the same for every provider. Do them alongside the article for your provider in Identity Provider Setup Guides, which explains what to create in your provider's console and where to find each value.
1. Open the Single Sign-On page
In MSPCFO, open the user menu (top right) and choose Single Sign-On. If nothing is set up yet, the page opens the setup form, SSO Provider Configuration.
2. Choose the provider
Select your identity provider. The labels, hints and examples on the form change to match it.
3. Copy the Callback URL
The form shows the Callback URL for that provider straight away. Copy it. You'll need it in the next step, because providers ask for it before they give you a client ID and secret.
4. Create the application in your identity provider
Follow the article for your provider in the next Chapter. Come back with the values it lists: directory/domain/hostname, client ID and client secret.
5. Fill in the form
| Field | What to enter |
|---|---|
| Directory / domain / hostname | The label depends on the provider: Directory (tenant) ID (Entra), Google Workspace domain (Google), Okta domain (Okta) or Duo SSO hostname (Duo). |
| Authorization server ID (optional) | Okta only. Usually left blank. |
| Client ID | The application's client ID from your provider. |
| Client secret | The application's client secret. It's stored encrypted and never shown again. When editing later, leave this blank to keep the current secret. |
| Profile for new SSO users | Required. The profile given to people whose account is created by their first SSO sign-in. Existing members keep their current profile. |
| Enable SSO for this company | Tick this to turn SSO on. The Test sign-in button only appears once SSO is enabled. |
| Enforce SSO (disable password login) | Leave this off for now. It can only be turned on after a successful test sign-in. |
6. Save
Choose Create SSO configuration. MSPCFO checks the format of what you entered. For example, a domain name where a GUID belongs, or an Okta or Duo address on the wrong domain, is refused with a message explaining what's expected.
Saving doesn't prove the values are correct. MSPCFO can only tell once your identity provider accepts them in a real sign-in, which is what Test sign-in does.
7. Run a test sign-in
Continue to the article Run a Test Sign-In.
0 Comments
Add your comment