Single Sign-On (SSO) Setup Guide

Single Sign-On (SSO) allows users to sign in to AppNavi using the credentials provided by your organization's identity provider (IdP).

AppNavi supports SSO through identity providers such as Microsoft Entra ID and Okta.

Use this page to review the shared SSO requirements, enable SSO in AppNavi, and validate the configuration.

For provider-specific configuration steps, use the dedicated guides below.

Prerequisites

Before configuring SSO, make sure you have:

1. Tenant Owner or Tenant Admin access to the AppNavi tenant.
2. An active AppNavi tenant.
3. An application registered with your identity provider.
4. Access to the identity provider's administration portal.
5. The required authentication details, such as:
   • Client ID
   • Client Secret
   • Callback (Redirect) URI
   • Authorization URI
   • Token URI
   • UserInfo URI
   • Issuer URI
   • Required scopes
     Note: The exact configuration values and steps depend on your identity provider.

Configure SSO in AppNavi

Before configuring your identity provider, enable SSO in AppNavi to obtain the Callback URI required by the identity provider.

1. Sign in to the AppNavi portal with your Tenant Owner or Tenant Admin account.
2. Go to Manage Tenant.
3. Open the Settings tab.
4. In the Authentication section, enable Single Sign-On.
5. Save the changes.
6. Open the OAuth tab that appears after SSO is enabled.
7. Copy the Callback URI. You will need this value when configuring your identity provider.

Note: Some identity providers refer to the Callback URI as the Redirect URI, Sign-in redirect URI, or Reply URL.

Configure Your Identity Provider

Choose the identity provider used by your organization and follow the corresponding guide:

Single Sign-On with Microsoft Entra ID

Configure AppNavi SSO with Microsoft Entra ID, including application registration, redirect URI, OAuth endpoints, client secret, claims, and testing.

Single Sign-On with Okta

Configure AppNavi SSO with Okta, including application creation, redirect URI, OAuth endpoints, client credentials, claims, and testing.

These guides contain the provider-specific configuration steps and screenshots.

Required OAuth Settings

Note:

• Some IdPs call “Redirect URI” or “Reply URL” what AppNavi labels as Callback URI.
• The "xxxxxxxx" in the table above represents the Tenant ID provided by AppNavi.
• Do not copy the example values from another identity provider into your configuration. Use the values generated for your own identity-provider application.

Validate the Configuration

After entering the OAuth settings:

• Review all values in the OAuth tab.
• Click Save Changes.
• Click Test Configuration.
• Follow the identity provider's sign-in flow.
• Confirm that authentication completes successfully and the user is redirected back to AppNavi.

A successful configuration should allow an authorized user to authenticate through the configured identity provider and access AppNavi.

User Requirements

For SSO authentication to work, the user must exist in both:

• The configured identity provider.
• AppNavi.

The email address returned by the identity provider must match the email address associated with the user's AppNavi account.

For provider-specific claim requirements, refer to:

• Microsoft Entra ID SSO
• Single Sign-On with Okta

SSO and Avatar Authentication

Portal SSO configuration is also used when SSO is enabled for Avatar authentication.

For information about enabling and configuring SSO for Avatar, see Single Sign-On Avatar.

The Avatar guide explains authentication modes and how users are authenticated through the configured identity provider.

Troubleshooting

If SSO authentication does not work, check the following:

Callback URI mismatch

Make sure the Callback URI configured in the identity provider exactly matches the Callback URI shown in AppNavi > Manage Tenant > OAuth.

User cannot sign in

Confirm that:

• The user exists in AppNavi.
• The user exists in the identity provider.
• The email address returned by the identity provider matches the email address in AppNavi.
• The user has been assigned access to the identity-provider application, where required.

Test Configuration fails

Review the following:

• Client ID
• Client Secret
• Authorization URI
• Token URI
• UserInfo URI
• Issuer
• Scopes
• Claim configuration

Make sure each value matches the configuration provided by your identity provider.

Authentication redirects to the identity provider but does not complete

Check the identity provider application configuration, particularly:

• Redirect URI
• Application/client type
• Required tokens or claims
• User assignment
• Client credentials