Overview
This article details the steps to configure the PXS and your Azure instance to support SSO. General information about SSO, like user administration and login details can be found on our Paytronix Customer SSO Guide.
NOTE: Organizations using Access Identity Unified Login cannot implement traditional SSO configurations, as Access Identity serves as the unified authentication system for all Paytronix products. If you are unsure if your organization uses Access Identity or SSO, please contact your IT administrator to confirm which authentication system your organization has implemented.
Setup
Create Enterprise Application.
Note: Since we are using OAUTH an enterprise application isnt strictly necessary. This helps with showing it on your SSO portal if you choose. If you do not care about it showing on the SSO portal, skip this section:
Click on 'Create your own application'
Name the Application per your preference. We will use ‘Paytronix’ in the examples
Ensure that ‘Integrate any other application you dont find the in the gallery (non-gallery)’ list item is selected.
Click Create
Go to Users and Groups and add the desired groups/users who can access the SSO
Go to ‘App Registrations’
Click All Applications
Search for the name of the Enterprise Application that you created and click on it to open
Go to Authentication
Edit Web Redirect URL and enter the URL for the Paytronix Environment you are creating SSO for.
Ensure that under Implicit grant and Hybrid flows that ID tokens (used for implicit and hybrid flows)is checked
Check the Supported Account Type. In many situations you will just select Accounts in this organization only
Click on API permissions
Click Add a permission and grant.
Microsoft.graph.email
Microsoft.graph.openid
Click Grant admin consent for {application name} to allow all users to access the SSO with pre-approval unless your corporate policy states otherwise.
Paytronix matches the Email address in PXS to the oauth claim field: email.
By default Azure does not pass the email claim. This is expected as PXS will look up the email field with a secondary request. If you need to specify a custom field for email address you can add a custom claim and set the email claim to whichever field matches the Paytronix Email field.
Click on Certificates and secrets
Click New Client Secret and enter a description and an expiration period.
Copy and save the value after you click add. it will only show one time. You can always recreate a secret if you lose access.
This secret will be required to be entered on the PXS side.
Click on Overview
Copy the Application (client ID)
Click on Endpoints and copy the OpenID Connect metadata document URL
You should now have the following information and have Azure AD configured for SSO:
Application Client ID
Application secret
OpenID metadata URL
These settings are needed within the PXS configuration to enable SSO.