Skip to content
AurionAI

Single sign-on for end users

5 min readBy Emmanuel Yazbeck

End-user single sign-on (SSO) lets your end users sign in with the identity provider of your organization. End users are the people who ask for support. They sign in to the Help Center and to the AurionAI mobile app.

Availability: all profiles. Administrators only.

Prerequisites

  • You have the Owner or Admin role.
  • The page is available in every product profile and on every plan.
  • You can create an app registration in one of these identity providers: Azure AD, Google Workspace or Okta.
  • The app registration must be separate from the one that your team uses for the dashboard. It must be a public client that uses Authorization Code with PKCE, without a client secret.

End users or dashboard staff

AurionAI has two separate sign-in policies. Use the right page:

Who signs in Where Page
End users (requesters and customers) Help Center, mobile app End-User SSO (this page)
Your team: administrators, supervisors and agents AurionAI dashboard Web Authentication

This page does not change how your team signs in to the dashboard. For the dashboard, read Dashboard authentication and sessions.

Open the page

  1. In the sidebar, select Configuration.
  2. Open the Identity & Access category.
  3. Select End-User SSO.

The End-User SSO Configuration page.

Turn on end-user SSO

  1. Turn on Enable SSO.
  2. In SSO Provider, select Azure AD, Google Workspace or Okta.
  3. Open the setup guide below the provider fields. It lists the steps to do in your identity provider. Follow these steps.
  4. Fill in the fields of your provider:
    • Azure AD: Azure AD Tenant ID and Azure AD Client ID (Public).
    • Google Workspace: Google Client ID.
    • Okta: Okta Domain and Okta Client ID.
  5. Under Redirect URIs, check Web Redirect URI and Mobile Redirect URI. AurionAI fills in the suggested values. Use the copy button next to each field.
  6. Register both redirect URIs in your identity provider with exactly the same values.
  7. Optional: in Allowed e-mail domains, enter the email domains of your organization, separated by commas, for example corp.com. Enter at most 50 domains, without the @ sign. Leave the field empty to turn off automatic creation of requesters.
  8. Select Save Configuration.

If your team already signs in to the dashboard with Azure AD, a message offers Use Admin Config. Select it to copy the tenant ID and the client ID into the form. You still need a separate app registration for end users.

For Okta, also add the origin of your Help Center as a trusted origin in Okta, with CORS turned on. The setup guide on the page explains this step.

Turn off end-user SSO

  1. Turn off Enable SSO.
  2. Select Save Configuration.

End users then sign in with the other methods of the Help Center and the mobile app.

Result

The message SSO configuration saved successfully appears.

The Help Center sign-in page then shows a button for your provider: Sign in with Microsoft, Sign in with Google or Sign in with Okta. The mobile app shows Sign in with your organization. The button appears the next time that an end user opens the sign-in page.

An end user can sign in with SSO when AurionAI already knows the person, or when the email domain of the person is in Allowed e-mail domains. In that case AurionAI creates the requester at the first sign-in. With Google Workspace, the hosted domain of the Google account must also be in the list. Otherwise AurionAI matches the email address of the person to an existing requester. The requester must be active, and both Allow Voice Support and Allow App Access must be on. Read Requesters (callers).

If something goes wrong

  • The save fails with an error message. If the message names a domain, correct that entry in Allowed e-mail domains. Otherwise, a provider is required when SSO is on. Each provider also needs its fields: both IDs for Azure AD, the client ID for Google, and the domain and the client ID for Okta.
  • The end user cannot sign in with SSO. The cause decides the message that the end user sees. With Azure AD or Okta, the Help Center shows Sign-in failed. Please return to the sign-in page and try again. for every cause below that reaches the Help Center. With Google Workspace, the message depends on the cause:
    • AurionAI has no requester with the email address that the identity provider sent. With Google Workspace, the end user sees No support account for this identity — contact your administrator. Check the email address of the requester.
    • The requester exists but cannot sign in. With Google Workspace, the end user sees No support account for this identity — contact your administrator. Check that the requester is active and that Allow Voice Support and Allow App Access are on.
    • The requester is locked after too many wrong badge numbers. With Google Workspace, the end user sees Login failed. Unlock the requester. Read Unlock a caller.
    • The settings in the identity provider do not match this page. The identity provider can show its own error. With Google Workspace, the Help Center can show Login failed. Check that the redirect URIs in your identity provider are exactly the same as on this page.
  • Okta sign-in fails in the Help Center. Add the Help Center origin as a trusted origin with CORS in Okta.
  • Failed to load SSO configuration. Reload the page.
  • Use Admin Config does not appear. Turn on Enable SSO first. The button appears only when Azure AD sign-in for the dashboard is active for your organization. It disappears when the Azure AD fields already have the same values as the dashboard sign-in.

Still stuck? Submit a request or .