Skip to main content
Deutsch (Deutschland) Español Français (France) Italiano Polski Slovenčina (Česko)

Search

search shadow

Articles in this section

Set Up SSO with project44

Mackenzie Nelson
Mackenzie Nelson
Updated

In this article

As a customer of project44, you have the option to configure Single Sign On (SSO) to access project44's products. Standard SSO supports one or more of your company's email domains.

SSO configuration is a collaborative effort between you and project44.

project44 uses Okta as its authentication broker to connect customer identity providers to the project44 platform. You do not need to log into or access Okta directly. Your IdP will reference Okta URLs for project44. However, you will always log in through Movement.

Pre-SSO Configuration

Prior to configuration, work with your project44 Customer Success contact to define your SSO experience needs. Specifically, determine the following:

  • What known set of email domains will you use?

  • Do you want to enable just-in-time (JIT) user creation? JIT users will be created with default access when they first log in via SSO.

    Note

    Roles for JIT users may need to be adjusted after the user is created to ensure the users are assigned the correct roles.

  • Which protocol do you want to use: OpenID Connect (OIDC) or Security Assertion Markup Language (SAML, specifically SAML 2.0)?

SSO Configuration Using SAML Protocol

  1. Create or configure a SAML application on your system using the following values as placeholders for the entityID and Application Callback URL respectively:

    1. https://www.okta.com/saml2/service-provider/{provider-ID}

    2. https://project44-americas.okta.com/sso/saml2/{IdP-ID} (NA), http://project44-europe.okta.com/sso/saml2/{IdP-ID} (EU)

  2. Send the following information to your project44 Customer Success contact:

    1. EntityID. This is a unique identifier for the SAML service provider.

    2. Application Callback URL

    3. Signing certificate. This should be in Base64 format.

  3. Your project44 Customer Success contact will provide you with the actual Entity ID and Callback URL to replace your placeholders.

  4. Once you have completed SSO configuration using the SAML Protocol, project44 will work with you to conduct Testing.

SSO Configuration Using OIDC Protocol

  1. Create an OIDC application and set the Redirect URI to one of the following based on your location:

    1. https://project44-americas.okta.com/oauth2/v1/authorize/callback (NA)

    2. https://project44-europe.okta.com/oauth2/v1/authorize/callback (EU)

  2. Send the following information to your project44 Customer Success contact:

    1. Client ID. This is your unique OIDC application identifier.

    2. Client Secret. This is a secret key used for OIDC authentication. Send this securely via a secret manager to keep it encrypted and with one-time use or access.

    3. Authorization URL

    4. Token URL

    5. Jwks URL

    6. Issuer URL

    7. Any other specific scopes that should be specified. The defaults are openid, profile, and email.

  3. Your project44 Customer Success contact will inform you know when it is time to conduct Testing.

Testing

The purpose of testing the SSO configuration is to ensure your preferences have been enabled and are working properly.

Some scenarios that can be tested include

  • JIT user creation. If enabled, does the new JIT user get created in the correct project44 account? If disabled, does SSO login by a new user not in project44 yet get rejected?

    • You have the option to send an email notification to to any email addresses of your choice when a new JIT user is created.

  • Existing user access. If your project44 account has been upgraded to enable SSO, instead of using a username and password, is the existing user able to successfully log in?

Production Launch

The Production Launch is when you are ready to go live with SSO. Work with your project44 Customer Success contact to determine the best date for this to occur.

Related articles