> For the complete documentation index, see [llms.txt](https://docs.ggwp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ggwp.com/identity-and-access-management-iam/sso.md).

# SSO

## Overview

Single Sign-On (SSO) is an authentication process that allows users to access multiple applications with a single set of login credentials. Implementing SSO provides several advantages for both users and companies. Here’s an overview tailored for a company that supports SSO on their dashboard:

## **Benefits**

1. **Enhanced User Experience:** SSO simplifies the login process, allowing users to access multiple applications seamlessly, improving their overall experience and productivity.
2. **Reduced Password Fatigue:** Users only need to remember one set of credentials, minimizing the burden of managing multiple passwords and reducing the likelihood of forgetting credentials.
3. **Improved Security:** By centralizing authentication, SSO can enhance security protocols. Organizations can implement stronger password policies and multi-factor authentication (MFA) on a single access point.
4. **Simplified User Management:** IT teams can manage user access rights across various applications from a central dashboard, enhancing efficiency in onboarding and offboarding processes.

## **Supported Identity Providers**

* Google Workspace
* Okta
* Azure
* Other standard OIDC providers

## Steps to setup

1. Configuring the application

{% tabs %}
{% tab title="Google Workspace" %}

1. Go to `Google Cloud Console` → `API & Services` → `OAuth consent screen`    
2. Select `Internal` (Workspace users only)
3. Fill in app name, support email and other details
4. Add required scopes: `openid`, `profile` and `email` and Save changes
5. Go to `API & Services` → `Credentials`
6. Click on `Create Credentials` → `OAuth Client ID`
7. Choose `Web Application`
8. Add GGWP's Redirect URL - `https://auth.ggwp.com/login/callback`\
   \
   ![](/files/19NYABxQ3MbCuegPZz8R)
9. Generate client credentials and securely save the `Client ID` and `Client Secret` 
10. Share `Client ID,` `Client Secret` and `Google Workspace Domain` with the GGWP Account Manager securely
    {% endtab %}

{% tab title="Other OIDCs (Okta, Azure etc.)" %}

1. Go to the corresponding IdP Admin console
2. Create a new application and select `OIDC/OAuth 2.0` 
3. Set application type to `Web Application` 
4. Enable Authorization Code flow (disable implicit flow if present)
5. Add GGWP's Redirect URL - `https://auth.ggwp.com/login/callback`
6. Configure scopes to include `openid, profile and email`
7. Generate client credentials and securely save the `Client ID` and `Client Secret` 
8. Identify the Issuer or Discovery URL, typically looks like - `https://<idp-domain>/.well-known/openid-configuration`
9. Assign users or groups to the application so login is permitted
10. Save and activate the application
11. Share  `Client ID` , `Client Secret`  and `Discovery URL` with the GGWP Account Manager securely
    {% endtab %}

{% tab title="SAML 2.0" %}

1. Receive the following details from GGWP
   1. `Entity ID` also known as `Audience` or `Identifier`&#x20;
   2. `Assertion Consumer Service (ACS) URL` also known as `Reply URL`&#x20;

2. Create a new SAML application in the preferred IdP. Common names -
   1. **Okta** → Create App Integration → SAML 2.0
   2. **Microsoft Entra ID** → Enterprise Application (Non-gallery)
   3. **OneLogin** → SAML Custom Connector (Advanced)

3. Configure the following SAML settings in the application created with the details shared by GGWP
   1. \
      `ACS URL` / `Reply URL`&#x20;
   2. `Entity ID` / `Audience`

4. Configure `NameID` to a stable, persistent identifier. It must be unique and must not change over time.

   | Setting       | Value      |
   | ------------- | ---------- |
   | NameID Format | Persistent |
   | NameID Value  | Email      |

5. Configure the following User Attributes / Claims in the SAML assertion

   | Attribute Name | Requirement | Source         |
   | -------------- | ----------- | -------------- |
   | email          | Required    | user.email     |
   | first\_name    | Optional    | user.firstName |
   | last\_name     | Optional    | user.lastName  |

6. Assign all users (or user groups) who require login access

7. Share the IdP metadata details with GGWP
   1. Preferred - IdP metadata XML file or its URL
   2. If metadata XML is not available, the following details
      1. `Sign-in URL` / `SAML 2.0 Endpoint`
      2. `X.509 Certificate`
      3. `IdP Entity ID`  &#x20;
         {% endtab %}
         {% endtabs %}

8. GGWP will enable SSO for your organization and update you when this is done.

## Login Post SSO Configuration

Once SSO has been enabled for your organization, users will be presented with the SSO option during login (see the screenshot below). They can choose to login either via SSO or username/password.

<figure><img src="/files/IYSXEkItPt6PtcNGlPaR" alt=""><figcaption></figcaption></figure>

## Important Notes

1. Once SSO is enabled, the `Admin` of the organization needs to add the user to the GGWP Dashboard using the `Manage Users (global)` [option available](/dashboard-user-guide/admin-features.md#adding-and-removing-users) in the left pane of the Dashboard.&#x20;
2. The added users would be able to login via both username/password as well as configured SSO. Both logins would take them to the same account.