Authentication and Single sign-on (SSO)
Essential knowledge
Intended Audience:
Technical User
Author:
Fluent Commerce
Changed on:
7 Jan 2026
Overview
Authentication in Fluent Web Apps is managed through PingOne, which serves as the central identity hub. It hosts the Fluent Identity Provider (Fluent IdP) and integrates with Corporate Identity Providers (Corporate IdPs) such as Azure AD, Okta, and Google Workspace. PingOne authenticates users, issues tokens, and enforces access and security policies across all environments.Key points
- SSO is supported only in the OMX framework.
- PingOne serves as the central identity platform managing all authentication requests.
- Fluent IdP (hosted in PingOne) handles Admin and API users.
- Corporate IdPs authenticate business users via SAML or OIDC.
- Once SSO is enabled, direct username/password login to Fluent Web Apps is disabled.
- Each Fluent account has its own PingOne environment where authentication and policy configurations are stored.
Understanding the Authentication Flow
When a user logs in to Fluent Web App, authentication is handled through PingOne, which routes the request to the correct Identity Provider (IdP) based on the user’s email domain.Step-by-step process:- The user enters their email on the Fluent Web App login page.
- PingOne identifies the domain (e.g., (e.g.,
`@google.com`,`@microsoft.com`) and determines whether the user belongs to the Fluent IdP or a Corporate IdP (e.g., Azure AD, Okta, Google Workspace):- If the user belongs to the Fluent IdP: PingOne authenticates credentials directly within the Fluent IdP (stored in PingOne).
- If the user belongs to a Corporate IdP: PingOne redirects the user to their organization’s IdP for authentication via SAML or OIDC.
- The IdP (Fluent or Corporate) verifies credentials and returns an assertion or ID token to PingOne.
- PingOne issues a verified session token to Fluent OMS, granting access.
- Internal users (Fluent-managed) to authenticate directly via Fluent IdP.
- External or vendor users to authenticate through their Corporate IdPs.
Fluent IdP vs Corporate IdP
PingOne acts as the host for both internal and external identity providers in the Fluent SSO model.| Aspect | Fluent IdP (Hosted in PingOne) | Corporate IdP (External) |
| Primary Use | Admin and API users | Business users |
| Authentication Method | Machine-to-machine or admin credentials | Redirected SAML/OIDC via PingOne |
| Managed In | PingOne SSO Environment | Corporate IdP (e.g., Azure AD, Okta, Google Workspace) |
| Web UI Access | Not supported | Supported via PingOne redirect |
API and Admin Users
Admin and API users are non-human accounts used for integration, automation, and administrative purposes. They are stored and authenticated through the Fluent IdP, which is part of PingOne.- Created via API or the Admin Console in Fluent Web Apps.
- Authenticate using machine-to-machine credentials.
- Not connected to any Corporate IdP.
- Only Admin and API users can generate API tokens.
- Business users must authenticate via their Corporate IdP.
- Direct Fluent login with username and password is unavailable for SSO-enabled users.
Password Policies and Security
Password policies are enforced at the PingOne environment level to maintain consistent security across both IdP types.- Corporate IdP: Policies apply only to API users.
- Fluent IdP: Policies apply to all users managed in PingOne.
- Default configuration disables all password policy options to ensure smooth post-migration login.
- When modified, users will be prompted to reset their password during their next login.
Authentication Behavior with SSO Enabled
Once SSO is active:- PingOne handles all credential validation and token issuance.
- Fluent OMS trusts the PingOne-issued token instead of performing
`client_secret`verification. - Access is granted based on the user’s IdP role and permissions.
Temporarily Disabling SSO
SSO can be temporarily disabled through the Settings API, allowing direct authentication using`client_secret `verification.To do this, update the SSO configuration via the API to disable the SSO flag. Once disabled, users can log in directly without being redirected to the Identity Provider (IdP). If you are unable to perform this action through the API, contact support for assistance.
