SSO integration | Gfacility

Integrations · Authentication · 1.4

With single sign-on (SSO), employees sign in to Gfacility through your own organisation’s identity provider, such as Microsoft Entra ID (formerly Azure AD) or OneLogin. Your IT decides who may sign in and on what terms. Gfacility supports OpenID Connect and SAML 2.0.

Both let employees sign in with their corporate Microsoft account, but through a different app in your Entra tenant. Choose one.

	Sign in with Microsoft	Single sign-on (SSO)
Which app	The Gfacility app	An app your IT creates itself
Setup	An admin approves once through a link	IT creates an app registration, the Gfacility admin enters the details
Who manages the app	Gfacility	Your own IT (who may sign in, how long a secret stays valid)
Best for	Getting started fast, little IT work	Organisations that want to keep control themselves

Going with Sign in with Microsoft? See Sign in with Microsoft. This article covers SSO.

This article always gives the URLs for production (app.gfacility.com) and UAT/test (uat.gfacility.com). Use the URL of the environment you are setting up.

1. Configuration via OpenID Connect (recommended)

OpenID Connect is the quickest to set up. The work is split between two people: your organisation’s IT admin (step A) and the Gfacility admin (step B).

A. In Microsoft Entra ID (IT admin)

Step	What to do
1	Go to entra.microsoft.com → App registrations → New registration. Enter a name (e.g. Gfacility SSO) and choose Accounts in this organizational directory only.
2	Under Redirect URI, choose the Web platform and enter: PROD: `https://app.gfacility.com/login/sso` UAT: `https://uat.gfacility.com/login/sso` Click Register.
3	On the Overview, note the Application (client) ID and the Directory (tenant) ID.
4	Click Endpoints and copy the OAuth 2.0 authorization endpoint (v2). It ends in `/oauth2/v2.0/authorize`.
5	Go to Authentication and tick ID tokens. Click Save.
6	Go to Certificates & secrets → New client secret. Copy the Value straight away (not the Secret ID); it is shown only once. Note the expiry date.
7	Go to API permissions. Check that `openid`, `profile` and `User.Read` are listed under Microsoft Graph (delegated). Click Grant admin consent for [organisation] and confirm.
8	Go to Enterprise applications → [app name] → Users and groups and add the employees or groups that may sign in.

B. In Gfacility (Gfacility admin)

Go to Integrations & Login → Single sign-on (SSO) → Add identity provider and choose Microsoft Entra ID (OpenID). Fill in:

Field in Gfacility	What to enter
Authority URL	The authorization endpoint from step 4, ending in `/oauth2/v2.0/authorize`
Redirect URL	Exactly the same URL as in step 2
Post-logout redirect URL	Optional, e.g. `https://app.gfacility.com/login`
Scope	Leave empty (Gfacility then uses `openid profile`)
Tenant ID	The Directory (tenant) ID from step 3
Client ID	The Application (client) ID from step 3
Client secret	The Value from step 6

Click Test connection. Only switch single sign-on on for everyone after you have tested with one user (see below).

Testing

Open a new private window and go to https://app.gfacility.com/login/sso?email=name@yourcompany.com (or uat. for the test environment). Sign in with that account. If you land in Gfacility, it works.

You see	Cause and fix
"Need admin approval"	The admin consent from step 7 is missing. If the screen names the Gfacility app instead of your own app, the sign-in is going through Sign in with Microsoft: use the link with `/login/sso`.
Error about the reply URL or redirect URI	The redirect URL in Gfacility and in Entra is not exactly the same. Check `https`, `app` or `uat`, and a trailing `/`.
"not assigned to a role" or similar	The user was not added in step 8.
Back in Gfacility, but not signed in	The user's email address in Gfacility must match their Microsoft sign-in name.

2. Configuration via SAML 2.0

SAML needs a one-time setup by Gfacility. So first agree with us which company name to use in the URLs. Then follow these steps in Microsoft Entra ID:

Step	What to do
1	Go to Applications → Enterprise applications → Overview.
2	Open the Azure AD SAML Toolkit. Not present? Click + New application.
3	In the left menu: Single sign-on.
4	Click Edit next to the default SAML configuration and fill in the URLs (see below).
5	Send us the details from step 3 (SAML certificates) and step 4 (Toolkit).

URLs for step 4

Replace {companyname} with the name you agreed with Gfacility.

Production

Identifier (Entity ID): https://app.gfacility.com/api/sso/{companyname}/metadata
Reply URL (ACS): https://app.gfacility.com/api/sso/{companyname}/acs
Sign-on URL: https://app.gfacility.com/login/sso

UAT / Test

Identifier (Entity ID): https://uat.gfacility.com/api/sso/{companyname}/metadata
Reply URL (ACS): https://uat.gfacility.com/api/sso/{companyname}/acs
Sign-on URL: https://uat.gfacility.com/login/sso

What do you send to Gfacility?

Step 3 (SAML certificates): App Federation Metadata URL.
Step 4 (SAML Toolkit): Sign-on URL, Microsoft Entra Identifier and Sign-out URL.

Once Gfacility has set up the connection, add an identity provider of type Microsoft Entra ID (SAML) in Gfacility under Integrations & Login → Single sign-on (SSO). Enter Entra’s login URL as the redirect URL.

See also the Microsoft article on configuring SAML in Entra for in-depth context.

Signing in with SSO

End users choose “Sign in with SSO” on the login screen. With a direct URL you can make this even easier:

Auto-detection

The user enters their email address once. The browser remembers it on later visits. Handy to put on the intranet.

PROD: https://app.gfacility.com/login/sso?email=auto

UAT: https://uat.gfacility.com/login/sso?email=auto

Specific URL

Pass the email in the URL (e.g. via your intranet). The user does not have to enter anything.

PROD: app.gfacility.com/login/sso?email=mail@user.com

UAT: uat.gfacility.com/login/sso?email=mail@user.com

← Previous: Sign in with Microsoft Next: Set up email sending→