Single Sign On (SSO) Implementation Guide

To manage your SSO configuration go to Integration tab | Single Sign On subsection | SAML 2.0 blue dot.

Open

Projector's SSO implementation uses a protocol called SAML 2.0. Any identity provider that supports SAML 2.0 should be compatible with Projector. We have help pages on configuring some identity providers.

To manage the SSO configuration you need the global permission System Settings set to Update.

To manage SSO settings for a user requires the global permission Users & Permissions set to Update.

Single Log Out -> Projector's SSO implementation does not support Single Log Out (SLO). If you log out of your identity provider it will not affect your Projector session. If you log out of Projector it will not affect your identity provider session.

Automatic Provisioning -> SAML supports automatic provisioning of new users. However, Projector does not support this feature since our user paradigm contains many fields which could not be automatically populated. For instance location, cost center, and salary type. Users will first need to be provisioned in Projector manually before their SSO account will work.

Sandboxes -> Each sandbox is a separate installation with its own SSO configuration. You can configure, test, and change SSO in a sandbox without affecting production. See Configure SSO in a Sandbox.

On your integration tab you will find values for your Assertion Consumer Service (ACS) URL and our Entity Provider ID. You need to create an application with your SSO Provider and enter these values.

Open

The ACS URL is unique to each installation because it includes your account code. The Entity ID is the same for every installation unless you override it (see below).

Most identity providers, including Microsoft Entra ID (Azure AD), Okta, and OneLogin, require every application in your tenant to have a unique Entity ID (also called the Identifier or Audience URI). If you set up more than one Projector installation with the same identity provider, such as production and a sandbox, give each one its own Entity ID.

1. Click Edit on the SAML 2.0 configuration screen

2. Tick the checkbox to override the Entity ID

3. Enter a unique value, for example ProjectorPSA-Sandbox

4. Save, then enter the same value as the Entity ID / Identifier in your identity provider's application

Open

If you only have one installation connected to your identity provider, you can leave the default Entity ID in place.

Your SSO provider will give you an x.509 security certificate and an endpoint URL. The certificate ensures the communication over SSO is private. 

• Enter your endpoint URL

• Copy your certificate to your clipboard using Load Certificate from Clipboard or use Load Certificate from File to upload one

Open

Once SSO is properly configured between Projector and your Service Provider, you can start configuring your users to use SSO. To start, we would recommend editing a single user and from the Overrides Tab | General Subtab enabling SSO. Once a single user has been verified to work properly, you can start turning the feature on in bulk from the User Type editor.

Projector offers three options for SSO login:

• Not enabled - users are expected to enter their Projector Credentials

• Optional - user is prompted to use SSO by default, but can enter a password and use their Projector Credentials instead

• Required - to access Projector Web a user must use SSO

Steps to enable SSO on a single user.

1. From Management Portal go to the Administration tab | Users & Resources subsection | Users blue dot

2. Query for a user and double click to open the user editor

3. From the User Type Overrides | General subtab tick the checkbox Single Sign on:

4. Choose Optional or Required

5. Visit https://app.projectorpsa.com/ and attempt to log in as the user

Open

Once you have verified a single user is working, you can start enabling SSO in bulk.

1. From Management Portal go to the Administration tab | Users & Resources subsection | User Types blue dot

2. Edit a user type

3. View the Assigned Users tab. Anyone whose name is in bold will be affected by this change

4. On the General tab choose Optional or Required from the Single Sign On dropdown

5. Visit https://app.projectorpsa.com/ and attempt to log in as a user
   
   

You'll want to confirm the following login scenarios. Remember to log out of Projector AND the IdP before each test. See the Single Sign On (SSO) User Guide for screenshots and a more detailed walk-through of these scenarios.

• Service provider initiated

  • Go to https://app.projectorpsa.com

  • Enter the username

  • Leave password blank

  • Enter account code if required

  • Click the Log in button. You should be redirected to your IdP to login. Afterwards you'll be redirected back to Projector and be signed in.

• Identity Provider initiated

  • Access the IdP's website and log in

  • Click the login link for Projector (IdP specific). You'll be immediately logged in.

Each Projector sandbox is a separate installation with its own SSO settings. You can set up SSO in a sandbox to test your identity provider configuration, or roll out changes, before touching production. Sandbox SSO supports the same SAML 2.0 settings and login options as production.

1. In your identity provider, create a separate application for the sandbox. Do not reuse the production application.

2. Log in to the sandbox's Management Portal and go to Integration tab | Single Sign On subsection | SAML 2.0.

3. Override the Entity ID with a unique value, for example ProjectorPSA-Sandbox. Enter the same value in the sandbox application.

4. Copy the sandbox's ACS URL into the sandbox application.

5. Enter the sandbox application's endpoint URL and certificate in the sandbox's SSO settings.

6. Make sure the test user exists in the sandbox and that their username matches the NameID your identity provider sends (usually their email address).

7. Enable SSO for that user as Optional, so they can still use a password if something is misconfigured.

8. Test both login scenarios under Test Configuration, using the sandbox account code.

See Single Sign On (SSO) Troubleshooting