# SSO Setup

Single Sign-On lets portal users log in to <code class="expression">space.vars.productName</code> without entering a separate username and password. Instead, they use the same login they already use for other company systems. This page provides an overview of setting up SSO.

## What is Single Sign-On

Single Sign-On (SSO) means users authenticate once with your organisation's login system and then automatically gain access to the <code class="expression">space.vars.productName</code> portal without being asked for credentials again.

Benefits include:

* **Convenience:** Users don't need to remember a separate password for the portal
* **Security:** Authentication is handled by your organisation's centralised identity system
* **Efficiency:** Faster login experience, especially for employees already logged in to company systems

## Prerequisites

Before setting up SSO, make sure you have:

* [ ] An identity provider (Microsoft Azure AD, Okta, OneLogin, or similar) already in use at your organisation
* [ ] Administrator access to both NetSuite and your identity provider
* [ ] <code class="expression">space.vars.productName</code> installed and basic access working with standard logins
* [ ] The SSO integration details from In8Sync (if required)

{% hint style="info" %}
Get <code class="expression">space.vars.productName</code> fully working with standard NetSuite logins first, then add SSO afterwards. This makes troubleshooting easier.
{% endhint %}

## Overview of the setup process

Setting up SSO for <code class="expression">space.vars.productName</code> involves configuration in two places: your identity provider and NetSuite.

### In your identity provider

{% stepper %}
{% step %}

### Create an application registration

Register a new application for <code class="expression">space.vars.productName</code> in your identity provider.
{% endstep %}

{% step %}

### Configure URLs

Set the login and redirect URLs (provided by In8Sync).
{% endstep %}

{% step %}

### Map user attributes

Set up user-attribute mapping so the identity provider sends the correct user information.
{% endstep %}

{% step %}

### Assign users

Assign the appropriate users or groups to the application.
{% endstep %}
{% endstepper %}

### In NetSuite

{% stepper %}
{% step %}

### Open SAML Single Sign-On

Go to **Setup > Integration > SAML Single Sign-on** (or the appropriate SSO settings for your method).
{% endstep %}

{% step %}

### Trust your identity provider

Configure NetSuite to trust your identity provider.
{% endstep %}

{% step %}

### Upload IdP credentials

Upload or enter the identity provider's certificate or metadata.
{% endstep %}

{% step %}

### Map identities to NetSuite users

Map the incoming user identity to NetSuite user records.
{% endstep %}

{% step %}

### Test the connection

Confirm the trust relationship works.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
The exact steps vary depending on your identity provider and the SSO method used (SAML, OAuth, or another protocol). Contact In8Sync for setup instructions specific to your environment.
{% endhint %}

## Testing SSO

After configuration:

1. Open the <code class="expression">space.vars.productName</code> portal URL in a browser where you're already logged in to your identity provider.
2. You should be automatically logged in to the portal without seeing a login screen.
3. If you're prompted for credentials, the SSO configuration may need adjustment.

Test with several different user types to make sure all roles work correctly:

* [ ] Test with an employee user
* [ ] Test with a customer user (if applicable)
* [ ] Test with different roles to verify each sees the correct portal pages

## What users experience

Once SSO is configured:

* **Already logged in to company systems:** The portal opens directly without a login screen.
* **Not yet logged in:** The user is redirected to your organisation's standard login page; after logging in there, they're sent back to the portal automatically.
* **Session expired:** The user may be asked to re-authenticate through the identity provider.

## Fallback access

{% hint style="warning" %}
Maintain at least one administrator account that can log in without SSO. This ensures you can always access the portal for troubleshooting if there's a problem with the identity provider.
{% endhint %}

## Common issues

| Problem                                    | Possible cause                                                                          | Solution                                                                      |
| ------------------------------------------ | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| User redirected to login but gets an error | Identity provider configuration is incorrect                                            | Check the redirect URLs and application settings in your identity provider    |
| User logs in but gets "access denied"      | The user's identity provider account isn't mapped to a NetSuite user with portal access | Verify the user has a matching NetSuite record with **Portal Access** enabled |
| SSO works for some users but not others    | Some users may not be assigned to the application in the identity provider              | Check user or group assignments in your identity provider                     |
| Loop between portal and login page         | Certificate or trust configuration mismatch                                             | Verify the identity provider certificate in NetSuite is current and correct   |

## Getting help

SSO configuration depends on your specific identity provider and network setup. For help:

* Contact **In8Sync support** for <code class="expression">space.vars.productName</code>-specific SSO guidance.
* Contact your **identity provider's support** for configuration help on their side.
* Contact your **NetSuite account manager** for NetSuite SSO feature questions.

## Related Pages

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Give User Access</strong></td><td>Granting access: required before SSO works.</td><td><a href="/pages/kj0wIYbCw5oo477q39gd">/pages/kj0wIYbCw5oo477q39gd</a></td></tr><tr><td><strong>Users Overview</strong></td><td>How user access works in <code class="expression">space.vars.productName</code>.</td><td><a href="/pages/VstrcxnPHJoNofmk5i1Y">/pages/VstrcxnPHJoNofmk5i1Y</a></td></tr><tr><td><strong>Access Issues</strong></td><td>Troubleshoot login problems including SSO redirects.</td><td><a href="/pages/9AUqCeZ4JQOYvcWGMnbq">/pages/9AUqCeZ4JQOYvcWGMnbq</a></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.in8sync.com/netsuite-admin-guide/overview-3/sso-setup.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.