Single Sign-On (SSO) Configuration Essentials

This collection covers the foundational concepts and key configuration principles for enabling and managing Single Sign-On (SSO) in Fluent Web Apps. Explore how SSO works, how identity providers are integrated, and how authentication flows are managed securely.

Authentication and Single sign-on (SSO)

Essential knowledgeAuthentication in Fluent Web Apps is managed through PingOne, which serves as the central identity hub. It hosts the Fluent Identity Provider (Fluent IdP) and integrates with Corporate Identity Providers (Corporate IdPs) such as Azure AD, Okta, and Google Workspace. PingOne authenticates users, issues tokens, and enforces access and security policies across all environments.

SSO is supported only in the OMX framework.
PingOne serves as the central identity platform managing all authentication requests.
Fluent IdP (hosted in PingOne) handles Admin and API users.
Corporate IdPs authenticate business users via SAML or OIDC.
Once SSO is enabled, direct username/password login to Fluent Web Apps is disabled.
Each Fluent account has its own PingOne environment where authentication and policy configurations are stored.

Corporate Identity Provider (IdP) Integration

Essential knowledgeIf a company has an internal IdP then this IdP can be integrated with our SSO Vendor and used for future user authentication.API user is always managed in the SSO vendor environment and doesn't have an MFA authentication option.

For SSO to work, you need to establish a connection between your Corporate IdP and our vendor IdP. Once the relationship is established then your password policies and MFA configuration will be used during user authentication in Fluent.

Federated Identity Provider (IdP)

Essential knowledgeFederated identity management means establishing of a trusted relationship between separate organizations and third parties, allowing users to authenticate to one domain and access resources in another without a separate login, enhancing security and user satisfaction. Fluent's Federated SSO utilizes protocols like SAML and OIDC for secure data exchange, providing a seamless single sign-on experience across Fluent OMX applications. These open standards enable the secure transmission of authentication and access information across domains

Federated IdP data storage

Fluent Commerce Fundamentals

Essential knowledgeThis is a guidepost for Developers highlighting important guides and articles to speed up Fluent Commerce's learning process.

Workflows that consist of states, rulesets, triggers, user actions, and Modules, used for distributing workflows and it's artifacts, are a key part of the Fluent Commerce platform.
Settings are used to adjust Workflow execution

Fluent Identity Provider (IdP)

Essential knowledgeAn identity provider (IdP) is a service that stores and manages digital identities. Companies use these services to allow their employees or users to connect with the resources they need. They provide a way to control access, adding or removing privileges, while security remains tight.For companies who don’t have corporate IdP, Fluent provides a solution that allows them to receive all SSO benefits without needing to support their own SSO solution.

An identity provider (IdP) is a service that stores and manages digital identities
For companies who don’t have corporate IdP, Fluent provides a solution that allows them to receive all SSO benefits without needing to support their own SSO solution.

Retailer Setup in SSO-Enabled Accounts

Essential knowledgeCreating new retailers within an SSO-enabled account involves specific considerations to ensure seamless integration and secure user management. This section provides guidelines on how to set up new retailers effectively post-SSO enablement.

Active SSO: With SSO activated, the `*_admin` user as `RETAILER` cannot access Fluent OMS via corporate IdP due to external IdP configurations.
User Role Management: Remove existing roles from `*_admin` users to restrict access appropriately.
User Creation: Create new users tailored for specific roles.

Single sign-on (SSO) Overview

Essential knowledgeSingle sign-on (SSO) is a session and user authentication module that gives users the ability to sign on once and with a single set of credentials to access multiple services and resources. It means is that the user will be authenticated against any Fluent platform application via corporate identity management provider (IdP) or Fluent IdP.

Benefits
Video Overview
Key Features
Further Reading

SSO

Essential knowledgeSingle Sign-On (SSO) in Fluent OMS allows organizations to centralize authentication through corporate Identity Providers (IdPs) such as Azure AD, Okta, or Google Workspace. Managed through PingOne, SSO provides a unified and secure login experience across users and environments.SSO is supported only for the OMX framework.

SSO provides unified authentication across multiple IdPs
Fluent integrates with PingOne for routing, authentication flows, and user provisioning
Once SSO is enabled, Admin and API users cannot log in to the Fluent Web Apps front end
Each Fluent account operates in a dedicated PingOne SSO vendor environment
All API users are stored in the Fluent IdP and authenticate via machine-to-machine flow

SSO Audit

Essential knowledgeThis page describes where to find user activity logs in SSO Environment. Ping Identity (SSO Vendor) logs all actions performed in the SSO admin console and keeps logs for two years by default. Review logs if you need to investigate an activity of a certain users or check a number of failed logins.

Ping Identity retains all SSO admin console activity logs for two years.
Audit reports allow administrators to review user actions, failed login attempts, and specific event activity.
To run an audit report: navigate to Environment → Audit and configure report parameters (Time Range, Primary Filter, Secondary Filter, Selected Fields, Time Zone).
Select Run to generate the report; columns can be rearranged, and detailed event information is available via the View option.
Additional audit functionality and field definitions are available in the Ping Identity audit guide.

SSO Authentication Policies Configuration

Essential knowledgeAuthentication policies dictate how the user's identity will be verified. For Corporate IdP all users are managed by corporate IdP and authentication policy needs to be configured to make sure that all users are authenticated via internal IdP.

The authentication policy needs to be configured to make sure that all users are authenticated via internal IdP.
API users and Fluent IdP users will be managed via separate authentication policies.