SSO
Essential knowledge
Intended Audience:
Technical User
Authors:
Fluent Commerce, Kirill Gaiduk
Changed on:
23 Oct 2026
Overview
Single Sign-On (SSO) in Fluent OMS allows organizations to centralize authentication through corporate Identity Providers (IdPs) such as Azure AD, Okta, or Google Workspace. Managed through PingOne, SSO provides a unified and secure login experience across users and environments.SSO is supported only for the OMX framework.Key points
- SSO provides unified authentication across multiple IdPs
- Fluent integrates with PingOne for routing, authentication flows, and user provisioning
- Once SSO is enabled, Admin and API users cannot log in to the Fluent Web Apps front end
- Each Fluent account operates in a dedicated PingOne SSO vendor environment
- All API users are stored in the Fluent IdP and authenticate via machine-to-machine flow
SSO Environment Setup
Each Fluent account is provisioned with an independent PingOne environment during SSO enablement. Setup is handled by the SRE or Success team and includes:- Creating and configuring the admin user
- Setting up authentication and password policies (default configuration is permissive and can be adjusted later)
- Enabling Fluent branding and Fluent OMX application
- Adding authentication flows for user and API access
Fluent User Creation and SSO Admin Permissions
All Fluent users must be created in the Fluent application, regardless of the selected IdP. User creation follows the standard process — users can be added via the API or through the Admin section in Fluent Web Apps.SSO vendor environment admin users have the following permissions:- Add integrations with Corporate IdPs (SAML / OpenID Connect)
- Enable or disable Fluent users
- Enable multi-factor authentication (MFA)
- Modify password policies
- Change environment branding
User Types & Access
The following table summarizes how different user types authenticate within an SSO-enabled environment:| User Type | Authentication Source | Notes |
| Corporate Users | Corporate IdP (e.g., Azure AD, Okta, Google Workspace) | Log in via corporate credentials through PingOne |
| API and Admin Users | Fluent IdP |
|
API User Management
API users represent system integrations rather than individuals. They must be stored in Fluent IdP and managed via API. They cannot exist within a Corporate IdP and do not interact with the Fluent Web Apps UI.API user credentials are maintained within the connected SSO vendor environment.Access Limitations
When SSO is active:- Only ADMIN and API users can generate API tokens.
- Regular users authenticate only via the external IdP.
- Direct Fluent login (username/password) is unavailable for SSO-enabled users.
Password Policy Configuration
Password policies apply to both Corporate IdP and Fluent IdP users, ensuring consistent security standards.- For Corporate IdP, password policies affect only API users.
- For Fluent IdP, policies apply to all users.
Refresh Token Format
The Fluent App in your PingOne environment uses opaque refresh tokens. PingOne is deprecating JSON Web Token (JWT) refresh tokens and requires all OpenID Connect (OIDC) applications to use opaque refresh tokens by March 1, 2027.- Fluent Web Apps do not use PingOne refresh tokens, so the refresh token format does not affect how users sign in
- If the Fluent App in your environment still uses JWT refresh tokens, PingOne shows the warning "Update this application to use opaque refresh tokens" next to it. This applies to applications created before January 27, 2026
- To remove the warning, change the Fluent App refresh token format to Opaque Token. See Switch the Fluent App to Opaque Refresh Tokens in PingOne
