Single sign-on

Overview

In addition to username and password login, FactFinder NG supports Single Sign-On (SSO).

If Enable Single Sign-On is enabled for a user, that user can sign in with SSO. You can find this option in the lower part of the user settings dialog:

Note: SSO only handles authentication. You still manage SSO user permissions in the FactFinder NG interface.

Location

Create and configure identity providers (IdPs) for SSO users on the Single Sign-On settings tab of the System information page:

Configuring Single Sign-On in NG

Clicking the checkmark saves your changes to the FactFinder NG configuration immediately:

Adding a new record to the table requires these attributes:

• Provider key — unique provider identifier. This key is used in the redirect URI.
• Display name — name shown on the login page.
• Issuer URL — URL of the provider endpoint.
• Client ID — ID configured at the provider.
• Client secret — secret configured at the provider.

Configuring NG in your Identity Provider

To complete the SSO setup, you must also configure NG as an application in your identity provider. This typically involves the following steps:

1. Register a new application in your identity provider management console.
2. Set the application type to Web application or a similar value.
3. Configure the redirect URI for the authentication response.
4. Generate client credentials for the NG configuration.

Redirect URI Configuration

The redirect URI tells the identity provider where to send the user after authentication. It must match exactly.

For NG, use the root URL of the UI with the query parameter idp=<providerKey>:

https://{your-ng-domain}/fact-finder-ui/?idp={provider-key}

Where:

• {your-ng-domain} is the domain where your NG instance is hosted.
• {provider-key} is the exact value entered in the Provider key field.

Important: The provider key in the redirect URI must exactly match the provider key configured in NG. If it does not, the authentication flow fails.

Identity Provider Requirements

Make sure your identity provider meets these requirements:

• The provider must be able to answer "OIDC Discovery" requests.
• The provider must be able to answer requests with the scopes openid, profile and offline_access.
• The OIDC claim which is parsed for the sake of user identification is called preferred_username and must be present in the identity tokens or access tokens returned by the IdP.
• Other required claims which have to be present in identity/access tokens are: sub, iss, iat, exp
• Tokens must be signed, and the signature must be verifiable with the corresponding public key which is returned by the JWKS endpoint of the IdP.

Logging in with SSO

The display name of each configured identity provider appears on the login page. In this example, click LOG IN VIA MICROSOFT to sign in with the IdP named Microsoft:

Each configured IdP adds its own login button to the page.

Logging in with credentials

To sign in with a username and password instead, click Log in with credentials:

Troubleshooting SSO Configuration

If you encounter issues with SSO login, check the following:

1. Verify the redirect URI — make sure the provider key exactly matches the value in NG.
2. Check client credentials — confirm the Client ID and Client Secret are correct.
3. Confirm the issuer URL — make sure the URL is correct and reachable from the NG server.
4. Review identity provider logs — check for authentication errors.
5. Contact FactFinder support — some issues require NG log analysis.

Limitations

SSO users cannot create or edit non-SSO users. This is intentional. It prevents offboarded users from keeping access to NG by disconnecting their accounts from SSO.

For the same reason, converting an SSO user back to a non-SSO user is not supported.

Keep at least one non-SSO administrator account for emergency access in case an IdP is unavailable. Use a username that does not exist on the IdP side so the account is never linked to SSO.

The same recommendation applies to the account used for FactFinder integration searches.

Users also cannot log in through multiple identity providers.