Docs
  1. Portal guides
  2. User Administration & Activity

Single Sign-On (SSO)

Let your employees log in to the Aera portal with your company's own login.

The Aera portal can connect to your identity provider (for example Microsoft Entra ID) with OpenID Connect (OIDC). Your identity provider confirms who the user is. The Aera portal decides what they can do, from the user's roles.

Before you start

RequirementDescription
Your main loginThe identity provider is your company's main way to log in.
OpenID ConnectYour identity provider supports OpenID Connect (OIDC).
EmailYour identity provider sends the email scope. The email in the id_token identifies the user, so it must match the user's email in the Aera portal.
User detailsFor each user: first name, last name, mobile number and email.
ApprovalAera approves your identity provider before it's connected.
Someone to add usersA super user for your organisation adds users in the Aera portal. The super user logs in with Aera Access.
One login per userEach user is linked to one identity provider.

How login works

Log in to the Aera portal with single sign-on
Employee
Aera portal
Your identity provider
1Email or phone, Start login
Step 1 of 6 · Employee → Aera portalThe employee enters their email address or phone number on the Aera portal login page.
2Redirect: client_id, scope, state
Step 2 of 6 · Aera portal → Your identity providerThe user is set up for single sign-on, so the portal sends them to your company's login page.
Logs in, if not logged in already
MeanwhileAlready logged in at your company? Then this step is skipped: that's the single sign-on. Your login may ask for extra steps.
3Redirect back with authorization code
Step 3 of 6 · Your identity provider → Aera portalYour identity provider sends the employee back to the portal's redirect URI.
4Exchange the code for an id_token
Step 4 of 6 · Aera portal → Your identity providerThe portal asks your identity provider for the id_token, server to server.
5id_token
Step 5 of 6 · Your identity provider → Aera portalThe id_token has the employee's email, which must match the user's email in the Aera portal.
6Logged in
Step 6 of 6 · Aera portal → EmployeeThe portal checks the id_token with your provider's public keys, finds the user by email and gives access by the user's roles in the portal.
Employee
Aera portal
Your identity provider
  1. 1
    Employee → Aera portal
    Email or phone, Start login
    The employee enters their email address or phone number on the Aera portal login page.
  2. 2
    Aera portal → Your identity provider
    Redirect: client_id, scope, state
    The user is set up for single sign-on, so the portal sends them to your company's login page.
  3. ·
    Meanwhile
    Logs in, if not logged in already
    Already logged in at your company? Then this step is skipped: that's the single sign-on. Your login may ask for extra steps.
  4. 3
    Your identity provider → Aera portal
    Redirect back with authorization code
    Your identity provider sends the employee back to the portal's redirect URI.
  5. 4
    Aera portal → Your identity provider
    Exchange the code for an id_token
    The portal asks your identity provider for the id_token, server to server.
  6. 5
    Your identity provider → Aera portal
    id_token
    The id_token has the employee's email, which must match the user's email in the Aera portal.
  7. 6
    Aera portal → Employee
    Logged in
    The portal checks the id_token with your provider's public keys, finds the user by email and gives access by the user's roles in the portal.

There are three ways in. They all use the same OpenID Connect flow.

Way inWhat the user does
Login page, not logged in at your companyEnters their phone number or email on the Aera portal login page. The portal sends them to your company's login page. After they log in, they come back to the portal. Your login may ask for extra steps.
Login page, already logged in at your companyEnters their phone number or email on the Aera portal login page, and comes straight back to the portal, without logging in again.
Your own linkAera can give you a link that goes straight to your company's login page and skips the Aera portal login page.

The Aera portal login page

Set up a user for single sign-on

  1. In the Aera portal, go to Users and click New User. See Create new user.
  2. Under Select user authentication method, choose Single Sign-On. It's the default. Choose Aera Access instead if the user shouldn't log in with your company's login.
  3. Enter the user's Email, First name, Last name and Phone number (with country code). The email must be the same as the user's email at your identity provider.
  4. Set the organisation access and roles as usual, and click Create User.

Choose Single Sign-On when you create the user

ℹ️

You can't change the login method later

To move a user between Single Sign-On and Aera Access, delete the user and create them again. See Manage users.

Connect your identity provider

Create an application for the Aera portal in your identity provider, and send Aera these details:

Send AeraDescription
Client IDThe ID of the application you created for the Aera portal.
Client secretThe secret for that application.
Issuer URIRecommended. If your identity provider doesn't support discovery (the well-known address), send the authorisation URI, token URI, user info URI and JWK set URI instead.
Allowed scopesAt least openid, profile and email.

Your application must accept this redirect URI:

EnvironmentRedirect URI
Staging and pre-productionhttps://api-staging.aerahost.com/gmap/oidcclient/login/oauth2/code/oidc
Productionhttps://api.aerahost.com/gmap/oidcclient/login/oauth2/code/oidc
❗️

Treat the client secret like a password

Share it only with Aera. The secret expires: create a new one before that date and send it to Aera, or your users can't log in.

Example: Microsoft Entra ID

Do this in the Microsoft Entra admin center.

1. Create the application

  1. Go to Entra ID → Enterprise apps and click New application.
  2. Click Create your own application.
  3. Enter a name, for example "Aera Portal".
  4. Choose Register an application to integrate with Microsoft Entra ID, and click Create.
  5. Choose Accounts in this organizational directory only, and click Register.

2. Allow only assigned users

  1. Go back to Entra ID → Enterprise apps, search for "Aera Portal" (or the name you chose) and open it.
  2. Under Manage → Properties, set Assignment required to Yes. The other properties are optional.
  3. Click Save.

3. Copy the client ID and the authority URL

  1. Under Single sign-on, choose Configure application properties and click Go to application.
  2. Copy the Application (client) ID. This is the client ID for Aera.
  3. Click Endpoints and copy the Authority URL. This is the issuer URI for Aera.

4. Create a client secret

  1. Click Add a certificate or secret, then New client secret.
  2. Enter a description, for example "Aera client 2026".
  3. Set Expires to 730 days (24 months), the longest Entra allows.
  4. Click Add, and copy the secret's Value at once. Entra doesn't show it again.

5. Add the redirect URI

  1. Under Authentication, click Add a platform and choose Web.
  2. Enter the redirect URI for the environment (see the table above), and click Save.
  3. Click Grant admin consent for your organisation.

6. Choose who can log in

  1. Under Overview, click Managed application in your directory.
  2. Under Users and groups, click None Selected.
  3. Add every group that should be able to log in to the Aera portal, click Select, then Assign.

Then send the client ID, client secret and issuer URI to Aera.

Updated 5 days ago

Did this page help you?