Single Sign-on (SSO)

The Upswell Experience Manage provides Single Sign On (SSO) using OAuth based flows from an organizations primary directory.

This document steps through obtaining the approriate credentials for supported SSO providers and activating SSO within the Experience Manager.

WARNING

SAML based SSO flows are not currently supported.

Supported Directories

The Experience Manager supports the following directories:

• Google Workspaces
• Microsoft Azure AD

Google and Microsoft cover the bulk of organizational SSO needs. If an additional directory is required, it may be added, contact Upswell for more information.

Required Configuration

When using SSO, the following configuration is required:

Variable	Value
SSO_ALLOWED_DOMAINS	Comma separated list of domains that can create accounts: mydomain.com,yourdomain.com

Directory Configuration

Google Workspaces

Provision OAuth Client ID and Secret

To configure a Google OAuth Integration:

1. Open the Google Cloud Console with an account in your organization: https://console.cloud.google.com/
2. Navigate to APIs and Services and select Credentials
3. Select + Create Credentials and select OAuth 2 client ID
4. Select and/or enter the following
   • Application Type: Web application
   • Name: Atlas Experience Manager
   • Authorized Redirect URI’s: Configure with your production URL: https://<production domain>/google/login/callback/
5. Select Create
6. From the pop-up, note the Client ID and the Client Secret (this is the last time you will see the Client Secret)

Enable SSO for Google Workspaces

SSO for Google Workspaces can be enabled by setting the following environment variables:

Variable	Value
USE_AUTH_GOOGLE	Enables SSO for Google Workspaces
GOOGLE_OAUTH_CLIENT_ID	The Client ID generated above
GOOGLE_OAUTH_CLIENT_SECRET	The Client Secret generated above

Additional Resources

• django-allauth
• Using OAuth 2.0 to Access Google APIs

Microsoft

Provision OAuth Client ID and Secret

App Registrations are managed through Azure at https://portal.azure.com.

1. Open the Azure Portal with an account in your organization: https://portal.azure.com
2. Locate App registrations under Enterprise applications / App registrations
3. Select + New registration
4. Select and/or enter the following:
   • Name: Atlas Experience Manager (or a name of your choice)
   • Supported account types select one of the following:
     • Choose Single tenant only to only allow user logins from your domain
     • Choose Multiple Entra ID tenants and Allow all tenants to allow all Microsoft for Work accounts
   • Redirect URI: Configure with your production URL https://<production domain>/google/login/callback/
   • Select Register
5. Locate Manage / Cwrtificates & secrets
6. Select +New client secret
7. Select and/or enter the following:
   • Description: <domain>.atlasss.app Production (or a name of your choice)
   • Expires: Select an expiration consistent with your organization credentials policy cycle
8. Note the Value and set as MICROSOFT_OAUTH_CLIENT_SECRET

Enable SSO for Microsoft

SSO for Google Workspaces can be enabled by setting the following environment variables:

Variable	Value
USE_AUTH_MICROSOFT	Enables SSO for Microsoft Azure Active Directory
MICROSOFT_OAUTH_CLIENT_ID	The Application (client) ID from the App registration overview page
MICROSOFT_OAUTH_CLIENT_SECRET	The secret generated under Certificates & secrets
MICROSOFT_OAUTH_TENANT	Set to organizations for Multiple Entra ID tenants and the Directory (tenant) ID from the App registration overview page