🚩 Caution: Changes to SSO settings can affect all users on your platform and their ability to access Front. Please contact us for assistance before making this transition if you have any questions.

Single sign-on is an authentication protocol that allows you to sign in to multiple applications one centralized authentication. Front supports single sign-on (SSO) using any SAML-based identity provider (IdP).

The setup guides for specific identity IdPs are below:

• Microsoft Azure Active Directory

• Okta

• Google

• SAASPASS

• OneLogin

• You will need administrative access to your respective IdP

• You must be a Front company admin

• You must have the Scale plan or above with Front

Step 1

Click the gear icon on the top right of Front and into the Company settings tab. Select Preferences and then click the Single sign on tab. Use the dropdown menu to select SAML.

Step 2

By selecting the SAML option, Front will automatically provide the values you need to add Front as a SAML 2.0 Service Provider to your identity provider:

• Entity ID: the identifier of our Service Provider.

• ACS URL: the URL of our Service Provider which will receive the SAML assertions.

• Name ID Format: the format of the name ID to use in SAML assertions.

• Encryption certificate: the certificate to encrypt SAML assertions.

Front will ask you to provide:

• Entry point: corresponding to your identity provider URL which will receive authentication requests.

• Signing certificate: to verify the signature of the responses received by our Service Provider.

• Requested authentication context: the authentication method Front will request the user follow.  Select Disabled if users follow any other method other than PasswordProtectedTransport.  Disabled is also recommended for teams using Microsoft Azure Active Directory as their IdP.

This is currently the only option available to enable SSO in Front.

Making changes to your team’s SSO configuration doesn’t invalidate existing sessions or log teammates out, but it will affect any new sign-on. Before proceeding:

• Keep a copy of the certificate you’re replacing in case the new one is invalid.

• Keep one admin session signed in while testing the new certificate to avoid being locked out.

Step 1

Click the gear icon on the top right of Front and into the Company settings tab. Select Preferences and then click the Single sign on tab.

Step 2

Update the Signing certificate and click Save.

Step 3

Test sign-on with another account.

The options on our login page (pictured below) utilize the OAuth standard similar to when you click Sign in with Google on any other website. The configuration described in this article is for a SAML-based authentication.

If you are interested in signing in with SSO using OAuth simply select the Sign in with Google or Sign in with Office 365 options on the login page. Company admins can also require all teammates to sign in using OAuth by following the steps here.

No. SSO can only be enabled at the company level and will require all users to authenticate using their IdP from that point forward.

Users are not automatically logged out by enabling SSO. Once you enable SSO upon a user's next login attempt they will be redirected to your SSO provider (as shown below). While a user will not be forced to log out of their existing session, they may encounter a session timeout if their idle time matches your company settings.

Generally speaking, yes. Some providers give you the ability to configure custom mappings however such that the email address associated with your user profile in Front may not need to match the one configured in your IdP. It is recommended that you ensure each user's login email is updated to match your IdP before enabling SSO.

While you can't bypass SSO for any account once enabled in Front, many providers give you the ability to utilize custom mappings for scenarios like this. Check directly with your provider to see if they support this type of configuration.

We do not provide a backup log-in URL where users can sign-in using their normal username and password. If you are unable to access the platform and have enabled SSO through an IdP, please contact us.

All versions of AAD support SSO. The only difference would be the number of SSO integrations you can have on your side - 10 vs. unlimited. 

User provisioning is fully supported for the Identity Providers (IdPs) listed here.

Front SCIM user provisioning functionality is accessible on Azure's Premium P1 or Premium P2 plans. You can find more information here.

This feature is available on the Scale plan or above. Some legacy plans may also have this feature.