How to Configure and Enable Operator SSO Using Microsoft Entra

Problem

You need to set up or review Single Sign-On (SSO) for Operator so that users can log in using their Microsoft Entra (Azure) credentials. This guide walks you through preparing your Gladstone environment, linking user accounts, and enabling SSO.

Resolution

1. Prepare User Accounts

   • Ensure all existing Gladstone user accounts in Operator have email addresses that match their Microsoft Entra account email addresses.
     • If emails do not match, duplicate users without permissions may be created.

2. Configure Users and Permissions

   • Existing users are linked via matching email addresses.
   • If a user logs in via Microsoft Entra and does not exist in Gladstone, auto-provisioning creates a new user with:
     • Auto-generated User ID (8 characters)
     • Auto-generated secure password
     • Force password reset enabled
     • No user roles assigned
     • Display name set to the Entra user's first and last name
     • Email address from Entra user
     • Site Group set to All sites
     • User Group ID set to STAND

3. Enable SSO in Microsoft Entra

   • Go to your configured Enterprise Application in Microsoft Entra.
   • Open the Single Sign-On settings.

4. Retrieve App Federation Metadata URL

   • In the SAML Certificates section, copy the App Federation Metadata URL.

5. Configure SSO in Operator

   • In Operator, go to Configuration > Integrations > Single Sign-On.
   • Paste the Metadata URL into the Authentication SAML Federation Metadata URL field.

6. Assign User Group in Microsoft Entra

   • In Microsoft Entra, navigate to the Enterprise Application.
   • Select Manage > Users and Groups.
   • Select the group containing your staff (Back Office) users.

7. Retrieve Group Object ID

   • Copy the Object ID for this group.

8. Configure Staff SSO in Operator

   • In Operator, return to Configuration > Integrations > Single Sign-On.
   • Enable the Staff SSO option.
   • Paste the Group Object ID.

9. Save the Configuration

   • Click Save to apply your changes.

Notes

• There is no facility to provide the password to users created via auto-provisioning. If users need to log in with a user ID and password (not SSO), another user with appropriate permission can reset the password in Plus2.
• Troubleshooting:
  • If users are created without permissions or duplicate users are appearing, make sure that user email addresses match between Gladstone and Microsoft Entra.
  • If a user cannot access Operator, check that they:
    • Have the correct roles assigned in the GMC.
    • Are included in the Entra Group being used for Staff SSO.
• Related Articles:
  • Single Sign-On (SSO): How to configure your Microsoft Entra account
  • Single Sign-On (SSO): The Consumer SSO experience
  • Single Sign-On (SSO): How to configure Gladstone products for Consumer SSO

This page as markdown · All pages · llms.txt