Setting Up Single Sign-On (SSO) for Your CRM

What is Single Sign-On (SSO)?

Single Sign-On (SSO) allows your team to access the CRM using their existing organizational login credentials. This streamlines the login process and enhances security by centralizing authentication through a trusted identity provider (IdP). The CRM supports SSO via the OpenID Connect (OIDC) protocol.

Prerequisites

Before you begin, ensure your agency meets the following requirements:

• Your agency must be subscribed to the $497 per month plan.
• A whitelabel domain must be configured for your agency.

Accessing the SSO Settings

To start configuring SSO, navigate to Company Settings and select Single Sign-On (SSO). Agency administrators have full access to view and modify these settings. You will see an Enable SSO button to begin the setup process.

Configuration Steps

Step 1: Enter Client ID and Secret

Obtain the following from your identity provider:

• Client ID: A unique identifier for your application within the IdP.
• Secret: A secure key used to authenticate requests between the CRM and your IdP.

Enter these details into the corresponding fields in the CRM.

Step 2: Configure OIDC Endpoints

You can set up the connection automatically or manually:

• Automatic Discovery (Recommended): Select Yes for Use OIDC Config URL and provide the configuration URL supplied by your IdP (typically ending in /.well-known/openid-configuration).
• Manual Configuration: Enter the specific endpoints provided by your IdP: Authorization URL, Token Endpoint, and User Info Endpoint.

Ensure the following scopes are configured in your IdP: openid is required; profile and email are recommended.

The CRM will prefill a Redirect URL for you. This URL must be added to the allowed callback URLs in your IdP configuration. It typically follows the pattern: https://<your-whitelabel-domain>/login/sso.

Step 3: Map User Details

Map the user attributes from your IdP to the CRM to ensure users are correctly identified:

• Remote ID Field (Required): The unique identifier for the user in your IdP (e.g., sub).
• ID Field (Optional): The corresponding user ID in the CRM, if you wish to map to existing users.
• Email Field: The field in your IdP that contains the user’s email address (e.g., email or userPrincipalName). This must be unique per user.
• Email Verified Field (Required): The field that confirms the user’s email has been verified by your IdP (e.g., email_verified).

Step 4: Review and Save

Double-check all entered information and save the configuration. After saving, you will see three sections:

• SSO Configuration: Displays your current settings.
• Test Status: Where you can validate your setup.
• Additional Settings: Contains toggles to enable SSO and optionally hide other login methods.

Testing and Enabling SSO

You must successfully test your configuration before enabling SSO. To test:

• Click Start Test in the Test Status section, or use the three-dot menu and select Test Configuration.
• This will simulate a login flow, redirecting you to your IdP to authenticate. After logging in, you will be returned to the CRM.
• If the test passes, you can enable SSO. If it fails, error messages will guide you on what to correct.

Note: Any changes to your SSO configuration will invalidate previous test results and disable SSO. You must run a new test to re-enable it.

Managing Your SSO Configuration

Editing a Configuration

Editing your SSO settings will disable SSO and expire all test results. You must perform a new test and re-enable SSO afterward.

Deleting a Configuration

Deleting an SSO configuration (via the three-dot menu) will reset all additional settings, expire test results, and disable SSO for all users.

Provider-Specific Guidance

Auth0

Create a Regular Web Application in Auth0. Copy the Client ID and Secret into the CRM. Add the CRM’s Redirect URL to the Allowed Callback URLs in Auth0. Use the config endpoint: https://YOUR_DOMAIN/.well-known/openid-configuration. Map Remote ID to sub, Email to email, and Email Verified to email_verified.

Azure Active Directory (Entra ID)

Register a new application in the Azure Portal. Add the CRM’s Redirect URI. Copy the Application (Client) ID and create a Client Secret for the CRM. Use the OpenID metadata document URL from the Endpoints section for the Config field. Map Remote ID to sub, Email to userPrincipalName, and Email Verified to email.

Okta

Create a new OIDC web application integration in Okta Admin. Add the CRM’s Redirect URL to Login redirect URIs. Copy the Client ID and Secret into the CRM. Use the Okta metadata URL: https://<okta-domain>/.well-known/openid-configuration. Assign users or groups as needed.