Single Sign-On (SSO) Setup Guide

Single Sign-On (SSO) allows users to sign in to AppNavi using the credentials provided by your organization's identity provider (IdP).

AppNavi supports SSO through identity providers such as Microsoft Entra ID and Okta.

Use this page to review the shared SSO requirements, enable SSO in AppNavi, and validate the configuration.

For provider-specific configuration steps, use the dedicated guides below.

Prerequisites

Before configuring SSO, make sure you have:

1. Tenant Owner or Tenant Admin access to the AppNavi tenant.
2. An active AppNavi tenant.
3. An application registered with your identity provider.
4. Access to the identity provider's administration portal.
5. The required authentication details, such as:
   • Client ID
   • Client Secret
   • Callback (Redirect) URI
   • Authorization URI
   • Token URI
   • UserInfo URI
   • Issuer URI
   • Required scopes
     Note: The exact configuration values and steps depend on your identity provider.

Configure SSO in AppNavi

Before configuring your identity provider, enable SSO in AppNavi to obtain the Callback URI required by the identity provider.

1. Sign in to the AppNavi portal with your Tenant Owner or Tenant Admin account.
2. Go to Manage Tenant.
3. Open the Settings tab.
4. In the Authentication section, enable Single Sign-On.
5. Save the changes.
6. Open the OAuth tab that appears after SSO is enabled.
7. Copy the Callback URI. You will need this value when configuring your identity provider.

Note: Some identity providers refer to the Callback URI as the Redirect URI, Sign-in redirect URI, or Reply URL.

Configure Your Identity Provider

Choose the identity provider used by your organization and follow the corresponding guide:

Single Sign-On with Microsoft Entra ID

Configure AppNavi SSO with Microsoft Entra ID, including application registration, redirect URI, OAuth endpoints, client secret, claims, and testing.

Single Sign-On with Okta

Configure AppNavi SSO with Okta, including application creation, redirect URI, OAuth endpoints, client credentials, claims, and testing.

These guides contain the provider-specific configuration steps and screenshots.

Required OAuth Settings

Note:

• Some IdPs call “Redirect URI” or “Reply URL” what AppNavi labels as Callback URI.
• The "xxxxxxxx" in the table above represents the Tenant ID provided by AppNavi.
• Do not copy the example values from another identity provider into your configuration. Use the values generated for your own identity-provider application.

Validate the Configuration

After entering the OAuth settings:

• Review all values in the OAuth tab.
• Click Save Changes.
• Click Test Configuration.
• Follow the identity provider's sign-in flow.
• Confirm that authentication completes successfully and the user is redirected back to AppNavi.

A successful configuration should allow an authorized user to authenticate through the configured identity provider and access AppNavi.

User Requirements

For SSO authentication to work, the user must exist in both:

• The configured identity provider.
• AppNavi.

The email address returned by the identity provider must match the email address associated with the user's AppNavi account.

For provider-specific claim requirements, refer to:

• Microsoft Entra ID SSO
• Single Sign-On with Okta

SSO and Avatar Authentication

Single Sign-On (SSO) allows users to sign in to the AppNavi Avatar using their organization's existing identity provider (IdP), such as Microsoft Entra ID or Okta.

The Avatar appears inside an integrated business application. When SSO is enabled, users can authenticate with their organizational accounts instead of entering separate AppNavi credentials.

Important: Avatar SSO and Portal SSO use the tenant's SSO configuration, but they serve different purposes:

• Portal login: Allows administrators to access the AppNavi management portal and configure tenant settings.
• Avatar login: Allows end users to authenticate while using AppNavi inside an integrated application.

Configure SSO for the Avatar

Step 1: Enable SSO for the Tenant

1. Sign in to the AppNavi portal using a Tenant Owner account.
2. Navigate to Manage Tenant → Settings.
3. Enable Single Sign-On (SSO) in the authentication settings.
4. Save the changes.
5. Open the OAuth tab and configure the required identity provider details.

Use the appropriate provider-specific guide:

Single Sign-On with Azure AD
Single Sign-On with Okta

Step 2: Configure the Application Authentication Mode

1. Navigate to Manage Tenant → Applications.
2. Open the application where the AppNavi Avatar is integrated.
3. Open the application settings.
4. Select the required authentication mode:
   • Single Sign-On (SSO): Users sign in through the configured identity provider.
   • Username/Password: Users sign in using their AppNavi credentials.
   • Both: Users can choose between SSO and username/password authentication.
5. Save the changes.

SSO Login Workflow

When a user selects SSO in the Avatar, the following process takes place:

• The user opens the business application where the AppNavi Avatar is integrated.
• The Avatar loads the saved tenant and application authentication settings.
• The user selects Login with SSO, if the option is displayed.
• AppNavi starts the authentication process using the configured identity provider.
• If authentication is required, the user is redirected to the identity provider or shown its sign-in window.
• The user authenticates using their organizational account.
• The identity provider returns the authentication result to AppNavi.
• AppNavi validates the returned identity information and identifies the user.
• The user gains access to the Avatar according to their configured permissions and role.

NOTE: An authorized user can sign in to the Avatar without entering separate AppNavi credentials.

Authentication Modes and Expected Login Screens

The login screen displayed in the Avatar depends on the selected application authentication mode and the tenant-level SSO-only setting.

If you face any problems while trying to log in using SSO, you can try resolving the issue by following these steps:

1. Clear the cookies associated with the Identity provider.
2. Once the cookies are cleared, attempt the login process again.

This should help to resolve any login issues you may be experiencing.

Troubleshooting

If SSO authentication does not work, check the following:

Callback URI mismatch

Make sure the Callback URI configured in the identity provider exactly matches the Callback URI shown in AppNavi > Manage Tenant > OAuth.

User cannot sign in

Confirm that:

• The user exists in AppNavi.
• The user exists in the identity provider.
• The email address returned by the identity provider matches the email address in AppNavi.
• The user has been assigned access to the identity-provider application, where required.

Test Configuration fails

Review the following:

• Client ID
• Client Secret
• Authorization URI
• Token URI
• UserInfo URI
• Issuer
• Scopes
• Claim configuration

Make sure each value matches the configuration provided by your identity provider.

Authentication redirects to the identity provider but does not complete

Check the identity provider application configuration, particularly:

• Redirect URI
• Application/client type
• Required tokens or claims
• User assignment
• Client credentials