July 2025 – Steps 7, 12-14 have been recently introduced to manage the Microsoft Entra requirements for Staff and Consumer Single Sign-On (SSO). If your Entra Enterprise account was previously configured, you may need to re-visit these steps to ensure your Entra account is compatible.
Introduction
This article will provide you with a step-by-step guide on all configuration requirements when activating the Gladstone SSO feature. All staff and consumer access control will consequently be controlled through your Microsoft Entra tenant and no longer by the Gladstone core solution. Please be aware, these steps should be done prior to configuring your Gladstone products.
Step 1: Configuration of your Microsoft Entra Tenant
- Log into your Microsoft Entra Admin Center
- On the left hand menu, select Identity > Applications > Enterprise Applications
- This should navigate you to Enterprise applications | All applications. Select the option "New application" underneath the title.
- Select "Create you own application"
- Enter a name for the application, for example GladstoneGo. This is just a label to identify it within the Entra admin center, so the naming won't affect the integration. Select the "Integrate any other application" option and select Create.
- This will populate your new application and provide an Overview page. Select "Users and Groups" from the left hand menu (it may also be available in the Getting Started menu). This will take you to a page where Users and Groups on your Entra tenancy can be assigned access to the SSO integration.
Note: As this SSO feature covers access for both Operator and Gladstone360, permissions for the applications themselves are configured within the Gladstone Management Console as previous.
- Whether you are using Staff SSO, Consumer SSO, or both, access to the specific Gladstone applications will be controlled through Groups. At a minimum you will require two groups. Firstly, a Gladstone Go Staff group for you back-office users, that is, anyone you want to access Operator and Gladstone360. Secondly, a Gladstone Go Consumer group for your members/consumers accessing Gladstone Go Consumer.
After assigning a Group to the Gladstone Go Enterprise Application, navigate to the Overview of the Group and copy its Object ID. This will need to be entered into Gladstone Operator.
- Once users and groups have been assigned, select the "Single Sign-on" option from the left hand menu (or "Set up single sign" on in the Getting Started menu)
- Select "SAML" as the single sign-on method
- Select "Edit" on the Basic SAML Configuration section
- Within the Entity ID section, provide the following configuration details:
- Identifier = gladstonesoftware.cloud
- Reply URL = https://samlauthentication.gladstonesoftware.cloud/api/samlauthentication/log-in-callback
- Select "Edit" on the Attributes & Claims section:
- Select "Add a group claim":
- Select "Groups assigned to the application", with "Group ID" as the Source Attribute and save.
- Within the SAML Certificates section, copy and make note of the "App Federation Metadata Url". This will be required when configuring Operator.
