Single Sign On

Single Sign On (SSO) allows administrators to integrate FP&A Plus with an Identity Provider (IDP) to create a seamless sign on experience for users.

Set Up SSO

The steps to set up SSO are as follows:

  1. Contact Prophix Support to request SSO be turned on.
  2. Get the necessary values from your IDP:

  3. In FP&A, go to Security Manager and select Tools > Single Sign On Settings.

  4. Complete the setup dialog with the values you collected in step 2, and click OK.

     Tip:  If you saved an XML "Metadata File" in step 2, in Autofill with Metadata File, beside File you can click to automatically fill in the values.

     Example:  

    A completed set up dialog appears similar to the following example:

  5. Open Internet Information Server and restart it.

    You are now ready to manage users under SSO.

Manage users under SSO

The procedures below are for managing users if your organization is running both SSO and Prophix Authentication.

Add a user to FP&A Plus and assign an authentication method

  1. In Security Manager, from the drop-down select Users and click .
  2. For each user that you add, use the Auth drop-down to assign an authentication method.

Convert users from FP&A or Windows authentication to SSO authentication

  • In Security Manager, select one or more users, then select Tools > Convert to SSO.

Convert users from SSO to Prophix Authentication

  • In Security Manager, select one or more users, then select Tools > Send Invitation.

SSO FAQ

What are the prerequisites to use SSO?

Your organization must have a supported SAML 2.0 identity provision system installed.

What Identity Providers are supported by SSO?

At this time FP&A supports the following IDPs:

  • Okta
  • ADFS
  • Azure AD

Why don't I see the SSO feature?

By default SSO is turned off. After SSO is turned on, in Security Manager the Single Sign On Settings option appears under the Tools menu.

How do I turn on SSO?

To turn on SSO, you must contact Prophix Support.

Can I use both types of authentication?

You can use FP&A Authentication or SSO, but not both. When you request activation of SSO, FP&A Authentication is turned off and you use SSO only.

What happens if I only use SSO?

You need to convert all existing users to SSO. When you add new users, they are automatically assigned SSO.

How do I turn off SSO?

To turn off SSO, you must contact Prophix Support.

What happens when SSO is turned off?

All users that were assigned SSO authentication are automatically converted to FP&A Authentication, and the administrator must send out invitation emails to these users. Also, the Single Sign On Settings option no longer appears under the Tools menu.

Does the Prophix Password Policy affect SSO?

After SSO is turned on, the password policy remains in effect but only for users assigned FP&A Authentication.

How does SSO authentication affect a user?

When a user assigned SSO authentication opens FP&A, instead of seeing the FP&A home page, the user sees your IDP's sign-in dialog.