> For the complete documentation index, see [llms.txt](https://docs.in8sync.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.in8sync.com/netsuite-admin-guide/overview-3/sso-setup.md).

# SSO Setup

Single Sign-On for SphericalBRM + POS: overview of the setup process across your identity provider and NetSuite, plus testing and fallback access guidance.

Single Sign-On lets portal users log in to <code class="expression">space.vars.productName</code> without entering a separate username and password. Instead, they use the same login they already use for other company systems. This page provides an overview of setting up SSO.

## What is Single Sign-On

Single Sign-On (SSO) means users authenticate once with your organisation's login system and then automatically gain access to the <code class="expression">space.vars.productName</code> portal without being asked for credentials again.

Benefits include:

* **Convenience:** Users don't need to remember a separate password for the portal
* **Security:** Authentication is handled by your organisation's centralised identity system
* **Efficiency:** Faster login experience, especially for employees already logged in to company systems

## Prerequisites

Before setting up SSO, make sure you have:

* [ ] An identity provider (Microsoft Azure AD, Okta, OneLogin, or similar) already in use at your organisation
* [ ] Administrator access to both NetSuite and your identity provider
* [ ] <code class="expression">space.vars.productName</code> installed and basic access working with standard logins
* [ ] The SSO integration details from In8Sync (if required)

{% hint style="info" %}
Get <code class="expression">space.vars.productName</code> fully working with standard NetSuite logins first, then add SSO afterwards. This makes troubleshooting easier.
{% endhint %}

## Overview of the setup process

Setting up SSO for <code class="expression">space.vars.productName</code> involves configuration in two places: your identity provider and NetSuite.

### In your identity provider

{% stepper %}
{% step %}

### Create an application registration

Register a new application for <code class="expression">space.vars.productName</code> in your identity provider.
{% endstep %}

{% step %}

### Configure URLs

Set the login and redirect URLs (provided by In8Sync).
{% endstep %}

{% step %}

### Map user attributes

Set up user-attribute mapping so the identity provider sends the correct user information.
{% endstep %}

{% step %}

### Assign users

Assign the appropriate users or groups to the application.
{% endstep %}
{% endstepper %}

### In NetSuite

{% stepper %}
{% step %}

### Open SAML Single Sign-On

Go to **Setup > Integration > SAML Single Sign-on** (or the appropriate SSO settings for your method).
{% endstep %}

{% step %}

### Trust your identity provider

Configure NetSuite to trust your identity provider.
{% endstep %}

{% step %}

### Upload IdP credentials

Upload or enter the identity provider's certificate or metadata.
{% endstep %}

{% step %}

### Map identities to NetSuite users

Map the incoming user identity to NetSuite user records.
{% endstep %}

{% step %}

### Test the connection

Confirm the trust relationship works.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
The exact steps vary depending on your identity provider and the SSO method used (SAML, OAuth, or another protocol). Contact In8Sync for setup instructions specific to your environment.
{% endhint %}

### In the Client Admin

If your organisation uses Keycloak for portal user provisioning, there is a third configuration step after the NetSuite setup: open the subsidiary settings page in the Client Admin and fill in the **Single Sign-On** panel (Domain, Realm Name, Client ID, Client Secret). This connects the portal's user-provisioning to your Keycloak instance so portal users are created automatically when you give them access.

See [Single Sign-On — Client Admin](/client-admin-guide/managing-users/sso-oauth.md) for the full steps.

## Testing SSO

After configuration:

1. Open the <code class="expression">space.vars.productName</code> portal URL in a browser where you're already logged in to your identity provider.
2. You should be automatically logged in to the portal without seeing a login screen.
3. If you're prompted for credentials, the SSO configuration may need adjustment.

Test with several different user types to make sure all roles work correctly:

* [ ] Test with an employee user
* [ ] Test with a customer user (if applicable)
* [ ] Test with different roles to verify each sees the correct portal pages

## What users experience

Once SSO is configured:

* **Already logged in to company systems:** The portal opens directly without a login screen.
* **Not yet logged in:** The user is redirected to your organisation's standard login page; after logging in there, they're sent back to the portal automatically.
* **Session expired:** The user may be asked to re-authenticate through the identity provider.

## Fallback access

{% hint style="warning" %}
Maintain at least one administrator account that can log in without SSO. This ensures you can always access the portal for troubleshooting if there's a problem with the identity provider.
{% endhint %}

## Common issues

| Problem                                    | Possible cause                                                                          | Solution                                                                      |
| ------------------------------------------ | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| User redirected to login but gets an error | Identity provider configuration is incorrect                                            | Check the redirect URLs and application settings in your identity provider    |
| User logs in but gets "access denied"      | The user's identity provider account isn't mapped to a NetSuite user with portal access | Verify the user has a matching NetSuite record with **Portal Access** enabled |
| SSO works for some users but not others    | Some users may not be assigned to the application in the identity provider              | Check user or group assignments in your identity provider                     |
| Loop between portal and login page         | Certificate or trust configuration mismatch                                             | Verify the identity provider certificate in NetSuite is current and correct   |

## Getting help

SSO configuration depends on your specific identity provider and network setup. For help:

* Contact **In8Sync support** for <code class="expression">space.vars.productName</code>-specific SSO guidance.
* Contact your **identity provider's support** for configuration help on their side.
* Contact your **NetSuite account manager** for NetSuite SSO feature questions.

## Related Pages

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Give User Access</strong></td><td>Granting access: required before SSO works.</td><td><a href="/client-admin-guide/managing-users/give-user-access.md">Give User Access</a></td></tr><tr><td><strong>Users Overview</strong></td><td>How user access works in <code class="expression">space.vars.productName</code>.</td><td><a href="/netsuite-admin-guide/overview-3.md">Users &amp; Access</a></td></tr><tr><td><strong>Access Issues</strong></td><td>Troubleshoot login problems including SSO redirects.</td><td><a href="/netsuite-admin-guide/common-issues/access.md">Access Issues</a></td></tr></tbody></table>