Retrieve SSO Client ID

This article outlines the setup of your O365 and GSuite SSO with your Hosted PBX service. You will need to provide the credentials to our onboarding team to get set up. To enable SSO for a domain, see Enable SSO for a Domain

Requirements

• Developer access to https://portal.azure.com
• Developer access to https://console.cloud.google.com/

1. 1

   Login to https://portal.azure.com  with your developer account.

   NOTE: If you haven't set up Office 365 for your domain, Microsoft provides a detailed guide at: https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-sign-user-overview

2. 2

   Select Azure Active Directory service.

   1. 1
      Use the search function to find it, if it is not visible on the dashboard.
3. 3

   Select App registrations from the side pane.

4. 4

   Register a New Application (if not previously performed) by clicking the + new registration button/link in the center pane.

5. 5

   The window should look similar to the below:

   https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/plxI-G97uQRblrBlcwvMSCXZmtt0Istn1iPvlE_4020/1595907072292-z14.png

6. 6

   Select the previously created App registration by clicking the Display name.

7. 7

   Copy the newly created Application (client) ID from the data set in the center of the pane and retain it for a future step.

8. 8

   Select Authentication from the side pane.

9. 9

   Under Platform Configurations choose +Add a platform.

10. 10

    In the resulting Configure platform pane, select Web

    https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/4frd433voa6i-KqIa22kz3Co3eelHCJP0RHppNSMv7U/1595907335160-8vQ.png

11. 11

    In the resulting Configure Web pane, enter one of the required Redirect URLs, the Logout URL and select Implicit Grant for both Access tokens and ID tokens. When complete click Configure.

12. 12

    Redirect URI: https://<PBX FQDN>/portal/msal.php

13. 13

    Logout URL: https://<PBX FQDN>/portal/login/logout

14. 14

    The window should look similar to the below:

    https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/YaChs2JfNVjePPafRCPE9DMbcGkDoLTdFnN34N4MZmQ/1595907421460-YvQ.png

15. 15

    Add the remaining required Redirect URLs by using the Add URI link at the bottom of the Web platform box.

    https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/NVByEuDA_YyOjlzk_crZ-FfyM_vglQqqenG9Gw88pmo/1595907617179-Uvw.png

16. 16

    ALL required Redirect URIs are below:

         \*  https://<PBX FQDN>/portal/msal.php (Added in step 10)

        \*   https://<PBX FQDN>/analytics/

        \*   https://<PBX FQDN>/video/

        \*   https://<PBX FQDN>/webphone {no trailing slash)

        \*   https://<PBX FQDN>/

17. 17

    The Web platform box should look similar to below:

    https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/uPXVink9fgt6QmtEiJUJhz0wyy16EDNJQcB2vJPQ_Qw/1595907746376-fRM.png

18. 18

    Click Save at the top of the page. Your Office 365 SSO service will now be fully configured and enabled on Azure.

    NOTE: You should have "personal Microsoft accounts" listed in the "Supported account types" section. If missing, navigate to the Manifest and set the 'signInAudience' parameter to "AzureADandPersonalMicrosoftAccount"

19. 19

    Provide the Application (client) ID to your onboarding team to finish setup

1. 1

   Login to https://console.cloud.google.com// with your developer account.

   NOTE: If you haven't set up G Suite for your domain, Google provides a guide at: https://support.google.com/domains/answer/6069226

2. 2

   Select APIs & Services > OAuth consent screen.

   https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/UCFMHRSqIH0qcRyUt5OUJNOQNhwDlzHAI21NCmHI38o/1595912435924-YUU.png

3. 3

   Select External and click Create.

   https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/cgb7PIabuE9ltCBnnyiaM6dyfm3WwHFFFa0R8SzFrRA/1595912478253-ML4.png

4. 4

   Set the Application Name to your preferred display name.

5. 5

   Add your top-level domain to Authorized Domains.

   NOTE: This section offers control over the application's display name, support email, and logo. These settings may be important to your branding but are not required.

   If you change your logo image Google will start a manual review process that can take up to 6 weeks. They might also require a link to your privacy policy. There are several free generators online that can assist.

   https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/1PnpQTh6wRY5nUTtsTSp1PwCPmNV3L_XxVycExbo5_I/1595913967277-kjQ.png

6. 6

   Click Create credentials > OAuth client ID.

   https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/ozMDlNSGx5dzYScMeb78gQtmtAsKFwY6FjU5wxibrOE/1595912703859-NJ0.png

7. 7

   Select Web application.

8. 8

   Set Name as desired.

9. 9

   Under Authorized JavaScript origins, add your portal's hostname (EG: https://manage.niftywidgets.co)

10. 10

    Click Create.

    https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/LukZkbx5w1Eaz9WUjRDVN0s9VxoKoJ9tmCTfZBu9kIE/1595912745908-d3o.png

11. 11

    Copy the newly created Client ID and provide it to your onboarding team to finish setup

    https://cdn.elev.io/file/uploads/VYtmahJgiiNC4Q7omNSQkjr0mA1mIm3IhwV3m1DP_lg/5XEaMoS-v1ZUl7yFlXez6qNwbnxISF5AOaCIKZbj3KU/1595912810427-8PU.png

• Google
  • https://app.ucaasnetwork.com:8091/reseller/<reseller name>/api/auth/google/callback
• M365
  • https://app.ucaasnetwork.com:8091/reseller/<reseller name>/api/auth/azure/callback
• You will replace <reseller name> with your company name with no spaces, and add reseller to the end.
  • For example: https://app.ucaasnetwork.com:8091/reseller/niftywidgetsresellerapi/auth/azure/callback
• Both Client Secret and Client ID must be provided to OIT for SSO to be configured for Tragofone.
• Google needs to add data access requirements, we recommend just SSO only which would need ./auth/userinfo.profile to be added