Skip to main content
Sign in

SSO setup guide

Marisa Potgieter

Set up single sign-on (SSO) between your Azure / Microsoft Entra ID tenant and the Powerfleet Keycloak identity platform. Two protocols are supported: OpenID Connect 1.0 and SAML 2.0.

Follow either Option A or Option B, not both.

Process overview

Option A: Connect with OpenID Connect

Option B: Connect with SAML

Process overview

  1. Configure an application in Azure / Entra ID using OpenID or SAML, following the steps in this article.
  2. Contact Support and include the details listed in the next section, including the subject line. A case is created in Salesforce. Read Contact the support department.
  3. Support routes the case to Advanced Support, where a Service Request is created for the Auth team.
  4. The Auth team creates the Keycloak client, adds your email domain(s) so they are discovered for SSO, and handles the Jira updates.
  5. Support notifies you that SSO has been set up. Support manages all communication with you throughout the request.
  6. SSO is now active. Your users sign in with SSO from their next login.

What to include in the support case

Use one of these subject lines so the case can be identified and routed correctly:

  • SSO Enable – to enable SSO
  • SSO Update – to update the SSO client secret

Collect these details while you complete the setup steps, then include them in the support case:

Detail OpenID SAML Where to find it
Company email domain(s) ✓ ✓ Your IT team
Display name (app name) ✓ ✓ Azure app Overview page
Application (Client) ID ✓ Azure app Overview page
OpenID Connect metadata document URL ✓ Endpoints tab (Option A, step 9)
Client secret value ✓ Certificates & secrets (Option A, step 17)
App Federation Metadata URL ✓ SAML-based Sign-on page (Option B, step 11)

The client secret is a password for your application. Share it only through the service request, never by email or chat, and note its expiry date. Create a new secret and send it to the Auth team before the current one expires, or SSO will stop working.

Option A: Connect with OpenID Connect

Register the application

  1. Sign in to the Azure portal.
  2. Under Manage Microsoft Entra ID, click View.

Screenshot 1

  1. In the left-hand side menu, expand Manage.

Screenshot 2

  1. Select App registrations.

Screenshot 3

  1. Click New registration.

Screenshot 4

If your company already has an application registered in Azure / Entra ID, select it from the list and skip to step 7.

  1. Fill in the required fields to register an application for your company, then click Register.

Screenshot 5

  1. On the app's Overview page, copy the following for the support case: * Display name * Application (client) ID

Screenshot 6

Copy the metadata URL

  1. Select the Endpoints tab.

Screenshot 7

  1. Copy the OpenID Connect metadata document URL for the service request.

Screenshot 8

Configure the redirect URL

  1. In the side menu, select Authentication (Preview), then click Add Redirect URL.

Screenshot 9

  1. Select Web.

Screenshot 10

  1. In the Redirect URL field, enter the following URL, replacing [App Name] with your app's display name: https://auth.fleetcomplete.com/auth/realms/fleetcomplete/broker/[App Name]/endpoint

  2. Enable both Access tokens and ID tokens.

  3. Click Configure.

Screenshot 11

Create a client secret

  1. In the side menu, select Certificates & secrets, then click New client secret.

Screenshot 12

  1. Enter a description, choose an expiry period, and click Add.

Screenshot 13

  1. Copy the secret Value right away and add it to the service request.

Screenshot 14

Azure shows the secret value only once. If you leave the page before copying it, you must create a new secret.

  1. Confirm with your IT team that the relevant Azure users have access to the new application.

Option B: Connect with SAML

Create the enterprise application

  1. Sign in to the Azure portal.
  2. Under Manage Microsoft Entra ID, click View.

Screenshot 1

  1. Click on Manage and select Enterprise applications.

Screenshot 15

  1. Click New application.

Screenshot 16

  1. Click Create your own application, enter a name, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

Screenshot 17

Configure SAML single sign-on

  1. In the side menu, under Manage select Single sign-on.

Screenshot 18

  1. Select SAML.

Screenshot 19

  1. In the Basic SAML Configuration section, click Edit.

Screenshot 20

  1. Enter the following values, replacing [App Name] with your application name:
    • Identifier (Entity ID): https://auth.fleetcomplete.com/auth/realms/fleetcomplete
    • Reply URL: https://auth.fleetcomplete.com/auth/realms/fleetcomplete/broker/[App Name]/endpoint

Screenshot 21

  1. Click Save.
  2. Copy the App Federation Metadata Url and add it to the service request.

Screenshot 22

Grant access

  1. Under Users and groups, assign the relevant users or groups to the new application so they can sign in with SSO.

RECOMMENDED READING

SSO - Sign in with your organization credentials

User management for SSO accounts

How sign-in works for each account type in Unity and On-Road IoT

Download SSO Setup Guide_V1.1.pdf

Related to

Related articles