SaaS Deployment - SSO

If you use Single Sign-On (SSO) for Software as a Service (SaaS), ensure that you meet the deployment requirements listed below. Additionally, your company must complete the necessary setup steps to enable SSO.

Supported Browsers

The following browsers are supported:

• Chrome 127 or above

• Microsoft Edge 127 or above

• Safari 17.6 or above

• Firefox 128 or above.

Internet Explorer is not supported.

Set Up Single Sign-On (SSO)

When logging in, users are authenticated using Single Sign-On (SSO) with their company user account. SaaS supports SSO via Microsoft Entra ID. Your company must set up SSO as follows:

1. Add an application registration for NEXUS in the Microsoft Entra admin center.

   1. Go to https://entra.microsoft.com/ to access the admin center.

   2. In the sidebar, go to Applications ‣ App registrations.

   3. Click New registration on the top of the page.

   4. On the page that opens, enter data as follows:

      • Name: Enter a display name, for example, NEXUS IC.

      • Supported account types: Select Accounts in this organizational directory only (Single tenant)

      • Redirect URI (optional): Select Single-page application (SPA) and enter https://license.nexusic.com/login/

   5. Click Register.

   Note

   Under Authentication, ensure that the options Access tokens (used for implicit flows) and ID tokens (used for implicit and hybrid flows) are NOT selected.

2. To enable secure logout from accounts, update token configuration as follows:

   1. In the sidebar of the new app registration page, go to Manage ‣ Token configuration.

   2. Click Add optional claim.

   3. Select ID for the token type.

   4. Select the login_hint option an click Add.

   

   
   

3. Verify API permissions:

   1. In the sidebar, go to Manage ‣ API permissions.

   2. Ensure that the default API permission User.Read under Microsoft Graph is added:

   

   
   

   3. To require users to request access during their initial login, set the Admin consent required value to Yes. This is optional and the default setting is No.

4. Once the application has been registered, provide Wood with the required data, see Information Required by Wood for SSO Setup.

5. Wood configures the authentication records and informs the company when it is completed.

Information Required by Wood for SSO Setup

Once the application has been registered, you must provide Wood with the following information:

1. The domain name of your User Principal Name (UPN) and any subdomain that your user accounts use, for example, *@woodplc.com, or *@contractor.woodplc.com.

2. Application (client) ID from the app registration

3. Authority URL (Accounts in this organizational directory only) from the app registration