Set up SSO for Phocas in Microsoft Entra ID

This page outlines how to configure Phocas with Microsoft Entra ID (previously called Azure AD) to enable single sign-on (SSO), a process typically carried out by the IT person in your organization with access to Entra ID.

The process involves moving between the two applications. The following key steps are outlined in detail below:

Enable SSO in Entra ID > Enter the Phocas SSO details into Entra ID > Enter the Entra ID SSO details into the Phocas and complete the SSO setup > Add the Phocas users and groups into Entra ID > Edit the user accounts in Phcoas to use the Entra ID usernames.

At the bottom of the page, you'll find some troubleshooting tips.

1. Enable SSO in Entra ID:

   1. Click + New > Enterprise Application.

   2. Click + Create your own application.

   3. Enter an application name in the text box.

   4. Select this option: Integrate any other application you don’t find in the gallery (Non-gallery).

      Open

      

   5. Click Create.

   6. In the 2. Set up single sign on panel, click Get started.

      Open

      

   7. Click SAML.

   8. In the Basic SAML Configuration panel, click the Edit button. Keep this screen open.

2. Enter the Phocas SSO details into Entra ID:

   1. In Phocas, click Administration > Configuration, then scroll down to the Single sign-on (SSO) > Service Provider section.

   2. Copy the Entity ID from Phocas, then in the Entra ID Identifier (Entity ID) section, click Add identifier and paste the ID into the box.

   3. Copy the ACS URL from Phocas, then in the Entra ID Reply URL (Assertion Consumer Service URL) section, click Add reply URL, and paste the URL into the box.

   4. Click Save.

3. Enter the Entra ID SSO details into the Phocas:

   1. Enter the Entra ID SAML certificate:

      1. On the Entra ID Single Sign On page, scroll down to the 3 SAML Certificates section and download the Certificate (Base64) file.

      2. Open the downloaded certificate file in Notepad and copy the contents.

      3. On the Phocas Configuration page, paste the copied certificate contents into the X509 Certificate box.

   2. Copy the Login URL from Entra and paste it into the Single Sign On Service URL box in the Indentity Provider (IP) section of the Phocas Configuration page.

   3. Copy the Entra Identifier from Entra and paste it into the Entity ID box in the Indentity Provider (IP) section of the Phocas Configuration page.

4. Complete the SSO setup on the Phocas Configuration page, then click Save.

5. In Entra ID, add the Phocas users and groups:

   1. Click Users and groups in the left-hand menu.

   2. Click + Add user/group.

   3. Click None selected.

   4. Locate and select the user(s) or group(s) you want to have access to Phocas, then click Select at the bottom.

   5. Click Assign.

6. In Phocas, update the user accounts (or create new user accounts) to use the Entra ID usernames. For example, use the email address or User Principal Name (UPN).

   • The usernames depend on the source attribute sent from Entra ID. This can be found in the Single sign-on > Attributes & Claims section.

   • Here’s an example of updated usernames in Phocas:

Troubleshooting

If the user signs in to Phocas using SSO and returns to the sign-in page, the issue is most likely a user authentication issue. The username in Entra must match the username in Phocas; just a matching email address will not work.

If you have permission to view your Phocas logs, you can check whether the username is correct in Phocas.

Go to Logs > Security and see what the Login failed via ‘SAML' entry shows for the user and what the error message is. Here is an example of such a log:

If the SSO is not working and the Logs > Security displays the following message, the configuration in Phocas is likely wrong. Repeat the steps above to set up the configuration again.

If you continue to have issues after setup, please contact our Support team.