Single Sign-On Provider Configuration

When selecting to use Microsoft as your identification provider, proceed as follows for the provider configuration:

Step 1: Create the application

1. From your browser, navigate to the following URL:

   https://portal.azure.com/

2. Sign into the Microsoft Azure portal with your appropriate credentials.

3. Navigate to the Azure Active Directory resource:

   1. Select to add an App Registration.

      For detailed explanations on this process, refer to the following Microsoft documentation:

      https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application

   2. Indicate an appropriate name for the application.

      For example:

      SYSPRO Authentication

      Users of your application might see the display name when they use the app, for example during sign-in. You can change the display name at any time and multiple app registrations can share the same name. The app registration's automatically generated Application (client) ID, not its display name, uniquely identifies your app within the identity platform.

   3. Select the supported account types:

      • Accounts in any organizational directory

        Select this option if you want users in any Azure Active Directory (Azure AD) tenant to be able to use your application. This option is appropriate if, for example, you're building a software-as-a-service (SaaS) application that you intend to provide to multiple organizations.

        This type of app is known as a multitenant application in the Microsoft identity platform.

   4. Against the Redirect URI field, select Public client/native (mobile & desktop).

   5. Select Register to complete the initial app registration.

   Once registration completes, the Azure portal displays the app registration's Overview pane.

Step 2: Configure the application

Once your application has been registered, navigate to the Authentication section from the Manage menu:

1. From the Platform configurations, select Add a platform.

2. From the Configure platforms screen, proceed as follows for single sign-on access within the SYSPRO Web UI (Avanti) and/or SYSPRO Desktop:

   Web

   1. Select Web.

   2. Within the Redirect URIs section, add http://localhost to the entry.

      You will add more to this entry in a later step.

   3. Within the Implicit grant and hybrid flows section, enable the Access tokens option.

   4. Select Configure to complete the platform configuration.

   5. Save your changes.

   Desktop

   1. Select Mobile and desktop applications.

   2. Enable the https://login.microsoftonline.com/common/oauth2/nativeclient option.

   3. Select Configure to complete the platform configuration.

   4. Once your platform has been configured, the Azure portal displays the app registration's Overview pane, from where you can view the Application (client) ID. Also called the client ID, this value uniquely identifies your application in the Microsoft identity platform.

      Record this client ID, as you'll need it later for the configuration within SYSPRO.

3. From the Authentication screen, select the Web configuration to add your required URLs within the Redirect URIs section.

   For example:

   Your users may access the SYSPRO Web UI (Avanti) from various URLs.

   A few examples could be:

   • http://192.168.5.16/sysproavanti/, where 192.168.5.16 indicates the IP address of the machine where SYSPRO Web UI (Avanti) is installed

   • https://zalpusername01/SYSPROAvanti/

   • https://zalpusername01.sysproglobal.com/SYSPROAvanti/

   View the following article to learn more about the Microsoft URL restrictions: https://learn.microsoft.com/en-us/azure/active-directory/develop/reply-url

Step 3: Retrieve the application credentials

The next step is to retrieve the credentials created for the application (i.e. client secret and client ID):

1. Once your application has been registered, navigate to the Certificates & secrets section from the Manage menu. This allows you to retrieve the Client Secret required for Web applications.

2. Select the New client secret function.

3. Indicate a Description for the client secret.

4. Indicate your required period against the Expires field.

5. Select the Add function.

Once completed, you are returned to the Certificates & secrets screen, from where you can retrieve the client secret.

When selecting to use Google as your identification provider, proceed as follows for the provider configuration:

Step 1: Create the application

1. From your browser, navigate to the following URL:

   https://console.cloud.google.com/

2. Sign into the Google Cloud portal with your appropriate credentials.

3. Click the Select a project button.

   1. From the Select a project screen, select the NEW PROJECT option.

   2. At the Project name field, indicate an appropriate name for your application.

      For example:

      SYSPROOAuth

   3. Select the Create function.

   Once saved, you are returned to the Google Cloud home page and a notification indicates that your application has been created.

Step 2: Configure the application

1. From the Google Cloud home page, select the project you have just created.

2. From the hamburger menu, select APIs & Services, followed by OAuth consent screen.

   From the OAuth consent screen:

   1. Indicate the User Type as External.

   2. Select the Create function.

3. The Edit app registration screen is displayed. Proceed as follows:

   App information

   1. Enter an appropriate name for your application within the App name field.

      For example:

      SYSPRO OAuth

      This name is displayed to your users (in the consent screen) when they sign in for the first time.

   2. Within the User support email field, indicate the email address to which your users can direct any queries.

   App logo

   1. Optionally upload and assign the logo you want associated with the application.

      This helps your users recognize your app and is displayed on the OAuth consent screen.

   2. After you upload a logo, you will need to submit your app for verification.

      For more detailed information regarding the verification, view the following Google documentation:

      https://support.google.com/cloud/answer/9110914

   Developer contact information

   1. Within the Email addresses field, enter the email address(es) for the developer contact(s).

      These email addresses are for Google to notify you about any changes to your project.

4. Select the SAVE AND CONTINUE function.

   Once saved, you are moved onto the next step in the Google configuration.

Step 3: Specify your scopes

From the Scopes section, you need to specify the scopes that this application will request. SYSPRO only requires read scopes on the user’s profile.

Scopes express the permissions that you request users to authorize for your app and allow your project to access specific types of private user data from their Google Account.

1. Select the ADD OR REMOVE SCOPES function.

2. From the Update selected scopes screen, enable the following entries:

   • .../auth/userinfo.email

   • .../auth/userinfo.profile

   • openid

3. Select the Update function.

   As the selected scopes are all non-sensitive, they are then displayed within the Your non-sensitive scopes section.

4. Select the SAVE AND CONTINUE function.

   Once saved, you are moved onto the next step in the Google configuration.

Step 4: Define the test users

While publishing status is set to Testing, only test users are able to access the app.

1. From the Test users section, use the ADD USERS function to indicate the email addresses of the users who will be testing your application.

   Ensure to add your own email address as well.

2. Select the SAVE AND CONTINUE function.

   Once saved, you are presented with a summary of your application's configuration.

3. Select the BACK TO DASHBOARD function.

Step 5: Create the required credentials (for desktop and web)

The next step is to create the credentials required for desktop and web access (depending on your requirements).

A client ID is used to identify a single app to Google's OAuth servers. If your app runs on multiple platforms, each will need its own client ID.

1. From the hamburger menu, select Credentials.

   This navigates you to the Credentials screen.

2. Select the CREATE CREDENTIALS function, followed by the OAuth client ID option.

   This opens the Create OAuth client ID screen. Proceed as follows for single sign-on access within the SYSPRO Web UI (Avanti) and/or SYSPRO Desktop:

   Web

   1. Within the Application type field, select Web application.

   2. Enter an applicable name for the OAuth 2.0 client.

      For example:

      SYSPROOAuthWebApp

      This name is only used to identify the client in the console and will not be shown to end users.

   3. Within the Authorised JavaScript origins section:

      Specify the appropriate URL host name that users will use to interact with the SYSPRO Web UI (Avanti).

      For example:

      • http://192.168.5.16, where 192.168.5.16 indicates the IP address of the machine where SYSPRO Web UI (Avanti) is installed

      • https://zalpusername01.sysproglobal.com

   4. Within the Authorised redirect URIs section:

      Specify the appropriate URL host name that users will use to interact with the SYSPRO Web UI (Avanti).

      For example:

      • http://192.168.5.16, where 192.168.5.16 indicates the IP address of the machine where SYSPRO Web UI (Avanti) is installed

      • https://zalpusername01.sysproglobal.com

   5. Select the CREATE function.

   Once created, the OAuth client created screen is displayed, from where your newly created Client ID and secret are displayed.

   Ensure to record the Client ID and the Client secret, as you'll need them later for the configuration within SYSPRO.

   Desktop

   1. Within the Application type field, select Desktop app.

   2. Enter an applicable name for the OAuth 2.0 client.

      For example:

      SYSPROOAuthDesktopApp

      This name is only used to identify the client in the console and will not be shown to end users.

   3. Select the CREATE function.

   Once created, the OAuth client created screen is displayed, from where your newly created Client ID and secret are displayed.

   Ensure to record the Client ID and the Client secret, as you'll need them later for the configuration within SYSPRO.

Step 6: Publish your application

Your application is now ready, but currently in a Testing phase, which means that access is currently only allowed for the email addresses added within step 4. Therefore, the last step is to publish your application (so that its available for all of your users):

1. From the hamburger menu, select OAuth consent screen.

2. Within the Publishing status section, select the PUBLISH APP function.

3. Confirm the system prompt to proceed with pushing the application to production.

When selecting to use LinkedIn as your identification provider, proceed as follows for the provider configuration:

Step 1: Create the application

1. From your browser, navigate to the following URL:

   https://developer.linkedin.com/

2. Sign into the LinkedIn Developers portal with your appropriate credentials.

3. Select the My apps option from the menu.

4. From the My apps page, select the Create app function:

   1. At the App name field, indicate an appropriate name for your application.

      For example:

      SYSPRO OAuth

   2. Within the LinkedIn Page field, indicate the URL for your company's LinkedIn page that will be associated with your app.

      For example:

      https://www.linkedin.com/company/syspro/mycompany/

      For more detailed information regarding LinkedIn page associations, view the following LinkedIn documentation:

      https://www.linkedin.com/help/linkedin/answer/a548360

   3. At the App logo section, upload the appropriate logo that will be displayed to users when they authorize with your application.

   4. Familiarize yourself with the LinkedIn Legal agreement and select the I have read and agree to these terms option.

   5. Select the Create app function.

   Once created, you are returned to the Products page.

Step 2: Apply the application's sign in with LinkedIn

The next step is to apply the sign in with LinkedIn capability:

1. From the Additional available products list, select the Request access option against the Sign In with LinkedIn product.

2. A confirmation window is displayed, from where you can familiarize yourself with the LinkedIn terms of use.

   Select the I have read and agree to these terms option, followed by the Request access function.

Once created, you are returned to the Products page.

Step 3: Retrieve the application credentials

Once your application has been defined with single sign-on, you need to retrieve the credentials created for the application (i.e. client secret and client ID):

1. While still in your newly created application, navigate to the Auth page.

2. Within the Application credentials section, take note of the Client ID and Client Secret.

Step 4: Configure the application

For access to LinkedIn member data, your application must be authenticated. LinkedIn relies on the industry standard OAuth 2.0 protocol for granting access.

Proceed as follows while still in your newly created application:

1. Within the Auth page, navigate to the OAuth 2.0 settings section.

2. Select the edit function (i.e. pencil icon) against the Authorized redirect URLs for your app option.

   This will allow you to add your redirect URLs for the web and/or desktop requirements.

3. Select the + Add redirect URL function.

   Web

   Specify the appropriate URL host name that users will use to interact with the SYSPRO Web UI (Avanti).

   For example:

   • http://192.168.5.16/sysproavanti/, where 192.168.5.16 indicates the IP address of the machine where SYSPRO Web UI (Avanti) is installed

   • http://zalpusername01/SYSPROAvanti/

   • https://zalpusername01.sysproglobal.com/SYSPROAvanti/

   Desktop

   Specify http://locahost as the URL host name that users will use to interact with the SYSPRO Desktop.

   These redirect URLs for both web and desktop are case-sensitive.

4. Once you've added the appropriate redirect URLs, select the Update function.

Once you have completed your application configuration with the required the identity provider(s), the final step is to configure SYSPRO to support the selected provider integration:

1. Launch SYSPRO 8 2023 (or later) and open the Setup Options program (SYSPRO Ribbon bar > Setup).

2. Navigate to the Login form within the System Setup category (Setup Options > System Setup > Login).

3. Ensure that the following setup options are disabled:

   • Active Directory sync required

   • Multi-factor authentication required

   The SSO Identity Provider Integration feature supersedes the previous methods of SSO using Active Directory and Multi-Factor Authentication.

   Therefore, it is necessary to disable these previous capabilities, before enabling the new SSO Identity Provider Integration, as the use of both methods simultaneously is not possible.

4. Within the Single sign-on identity providers section, enable the Identity providers required option.

5. Against the User applicability option, indicate to which operators this integration applies:

   • All operators except "Admin"

     This dictates that all operators require Identity Provider Authentication when logging into SYSPRO, except for SYSPRO operators with the operator code ADMIN.

     Be careful when selecting this option if you don't have an ADMIN operator.

   • All operators except administrators

     This dictates that all operators require Identity Provider Authentication when logging into SYSPRO, except for SYSPRO administrators.

     This is useful if the identity provider's system is not available (e.g. due to temporary network or provider unavailability) and operators can't access the defined authentication method in order to login to SYSPRO. An administrator can then still access SYSPRO (without requiring validation by the authentication methods that have been configured) to suspend the Identity Provider Authentication and allow operators to login.

     Therefore, all administrators should use strong operator passwords.

   • Specific operators

     This dictates that Identity Provider Authentication only applies to specific operators.

     Select the Define specific operators hyperlink to indicate the operators to which this Identity Provider authentication applies (using the Single Sign-On Operator Configuration Program: IMPSSP program).

6. Select the Configure identity providers hyperlink.

   This opens the Single Sign-On Provider Configuration Program: IMPSSI program, from where you can configure your selected identity provider(s):

   1. Select your required provider from the listview, followed by its configuration hyperlink within the Configure column.

   2. Within the configuration screen, define your requirements for the Desktop authentication and/or Web authentication, as per your organization's requirements:

      Desktop authentication

      Field	Action
      Enabled	This option must be enabled to allow desktop authentication using the selected identity provider.
      Default provider	Enable this option against the identity provider that you require as the default for desktop authentication. This option cannot be enabled for more than one provider at a time.
      Client ID	Indicate the Client ID created during your setup of the identity provider: = This is your desktop client ID generated using the Azure App Registration portal. = This is your desktop client ID generated using the Google Developer Console. = This is your client ID generated using the LinkedIn Developer Network portal.
      Client secret	Indicate the Client Secret created during your setup of the identity provider: = Not applicable for desktop authentication. = This is your desktop client secret generated using the Google Developer Console. = This is your client secret generated using the LinkedIn Developer Network portal.

      Web authentication

      Field	Action
      Enabled	This option must be enabled to allow web authentication using the selected identity provider.
      Default provider	Enable this option against the identity provider that you require as the default for web authentication. This option cannot be enabled for more than one provider at a time.
      Client ID	Indicate the Client ID created during your setup of the identity provider: = This is your web client ID generated using the Azure App Registration portal. = This is your web client ID generated using the Google Developer Console. = This is your client ID generated using the LinkedIn Developer Network portal.
      Client secret	Indicate the Client Secret created during your setup of the identity provider: = This is your web client secret generated using the Azure App Registration portal. = This is your web client secret generated using the Google Developer Console. = This is your client secret generated using the LinkedIn Developer Network portal.

   3. Once you have completed your provider configuration, use the Test connection hyperlink to ensure all entries are valid and that the connection to each provider is configured correctly.

7. Exit the program.

8. Restart SYSPRO for your changes to take effect.

Considerations:

If you enable and configure SSO Identity Provider Integration using the SYSPRO Web UI (Avanti):

• You may need to refresh your browser and restart your SYSPRO Web UI (Avanti) instance for changes to take effect.

If you enable and configure SSO Identity Provider Integration using the SYSPRO Desktop UI:

• You must restart your SYSPRO Web UI (Avanti) instance for changes to reflect in the Web UI.

• This applies to enabling the capability, as well as any changes made to the Identity Provider configuration.

• Operators can link more than one identity provider to their SYSPRO operator code.

• When a SYSPRO operator code is linked to an SSO identity provider, the flags against the operator record are set to indicate that SSO authentication is in-force.

• In the scenario that someone can no longer login using a specific identity provider, the system administrator can login and use the Single Sign-On Operator Configuration Program: IMPSSP program to allow the SYSPRO Authentication (i.e. traditional user name and password) to be used.

  This is achieved by disabling or pausing SSO for the operator.

  An alternative option (e.g. if the Single sign-on identity providers is not set ‘per operator’) is for an administrator to use the Force SSO registration at next login option within the Operator Maintenance program.

  Enabling this option removes the operator's previous SSO history and forces the operator to re-authenticate their SSO Identity Provider login details the next time they login to SYSPRO.

• If an operator is defined to use Single sign-on identity providers for their authentication (and they have logged in at least once using one of the identity providers) then all subsequent logins must use an identity provider for their authentication. Therefore, they can no longer log into SYSPRO using their traditional user name and password after linking their operator code to an identity provider.

  The only exception to this, is if their Single sign-on identity providers authentication has been paused or disabled by the administrator (using the Single Sign-On Operator Configuration Program: IMPSSP program).

• If an operator cancels out from the authentication dialog, they are returned to the main login screen.

• If an operator defined to use Single sign-on identity providers attempts to use an alternative user interface where no identity providers have been enabled, then they will not be able to login to that user interface.