> For the complete documentation index, see [llms.txt](https://docs.fact-finder.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fact-finder.com/docs/system-maintenance-and-security/factfinder-ng-user-management/sso.md).

# Single sign-on

## Overview

In addition to username and password login, FactFinder NG supports Single Sign-On (SSO).

If **Enable Single Sign-On** is enabled for a user, that user can sign in with SSO. You can find this option in the lower part of the user settings dialog:

![](/files/lp3VkHuedo4hklY4rz6W)

> **Note:** SSO only handles authentication. You still manage SSO user permissions in the FactFinder NG interface.

## Location

Create and configure **identity providers (IdPs)** for SSO users on the **Single Sign-On settings** tab of the [System information](/docs/system-maintenance-and-security/system-information/system-information.md) page:

![](/files/YGZxcORHPWG2FyFLXWaq)

## Configuring Single Sign-On in NG

Clicking the checkmark saves your changes to the FactFinder NG configuration immediately:

![](/files/dsjHuArzrkWtCuaUj94m)

Adding a new record to the table requires these attributes:

* **Provider key** — unique provider identifier. This key is used in the redirect URI.
* **Display name** — name shown on the login page.
* **Issuer URL** — URL of the provider endpoint.
* **Client ID** — ID configured at the provider.
* **Client secret** — secret configured at the provider.

## Configuring NG in your Identity Provider

To complete the SSO setup, you must also configure NG as an application in your identity provider. This typically involves the following steps:

1. **Register a new application** in your identity provider management console.
2. **Set the application type** to **Web application** or a similar value.
3. **Configure the redirect URI** for the authentication response.
4. **Generate client credentials** for the NG configuration.

### Redirect URI Configuration

The redirect URI tells the identity provider where to send the user after authentication. It must match exactly.

For NG, use the root URL of the UI with the query parameter `idp=<providerKey>`:

```
https://{your-ng-domain}/fact-finder-ui/?idp={provider-key}
```

Where:

* `{your-ng-domain}` is the domain where your NG instance is hosted.
* `{provider-key}` is the exact value entered in the **Provider key** field.

> **Important:** The provider key in the redirect URI must exactly match the provider key configured in NG. If it does not, the authentication flow fails.

### Identity Provider Requirements

Make sure your identity provider meets these requirements:

* The provider must be able to answer "OIDC Discovery" requests.
* The provider must be able to answer requests with the scopes `openid`, `profile` and `offline_access`.
* The OIDC claim which is parsed for the sake of user identification is called `preferred_username` and must be present in the identity tokens or access tokens returned by the IdP.
* Other required claims which have to be present in identity/access tokens are: `sub`, `iss`, `iat`, `exp`
* Tokens must be signed, and the signature must be verifiable with the corresponding public key which is returned by the JWKS endpoint of the IdP.

## Logging in with SSO

The display name of each configured identity provider appears on the login page. In this example, click **LOG IN VIA MICROSOFT** to sign in with the IdP named **Microsoft**:

![](/files/4Vrj7r0Hk2ogBqaEmQZI)

Each configured IdP adds its own login button to the page.

## Logging in with credentials

To sign in with a username and password instead, click **Log in with credentials**:

![](/files/tpylJvFaAQrnRtU9CLql)

## Troubleshooting SSO Configuration

If you encounter issues with SSO login, check the following:

1. **Verify the redirect URI** — make sure the provider key exactly matches the value in NG.
2. **Check client credentials** — confirm the Client ID and Client Secret are correct.
3. **Confirm the issuer URL** — make sure the URL is correct and reachable from the NG server.
4. **Review identity provider logs** — check for authentication errors.
5. **Contact FactFinder support** — some issues require NG log analysis.

## Limitations

SSO users cannot create or edit non-SSO users. This is intentional. It prevents offboarded users from keeping access to NG by disconnecting their accounts from SSO.

For the same reason, converting an SSO user back to a non-SSO user is not supported.

Keep at least one non-SSO administrator account for emergency access in case an IdP is unavailable. Use a username that does not exist on the IdP side so the account is never linked to SSO.

The same recommendation applies to the account used for FactFinder integration searches.

Users also cannot log in through multiple identity providers.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fact-finder.com/docs/system-maintenance-and-security/factfinder-ng-user-management/sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.