Skip to Content
SecurityAuth SettingsSingle Sign-On (SSO)

Single Sign-On (SSO)

Requires the Pro plan or above.

Toggle Enable SSO to federate sign-in through an external identity provider. On plans without SSO, the toggle is disabled with an Upgrade to Pro link.

Two providers are supported: Google Workspace and Microsoft Azure AD / Entra ID.

Single Sign-On section showing configured provider cards

Each configured provider appears as a card with its status (Active/Disabled) and a menu to View Config, Edit Configuration, or Remove Provider.

Adding a provider

Click + Add SSO Provider and pick Google Workspace or Microsoft Azure AD / Entra ID. The dialog shows a Redirect URI — copy it now, since both providers need it. The setup below happens in your provider’s console, in a separate tab; you’ll come back to paste in what it gives you.

Add SSO Provider dialog showing setup steps, redirect URI, and provider credential fields

Setting up Google Workspace

  1. Go to the Google Cloud Console  and select or create a project.
  2. Go to APIs & Services → OAuth consent screen. If it isn’t already configured, choose a User Type (Internal restricts sign-in to your Workspace only; External allows any Google account), fill in the required app details (app name, support email), and save.
  3. Go to APIs & Services → Credentials → Create Credentials → OAuth client ID.
  4. Set Application type to Web application.
  5. Under Authorized redirect URIs, paste the Redirect URI you copied from qRaptor.
  6. Click Create. Google shows you a Client ID and Client Secret — copy both.
  7. Back in qRaptor’s dialog, paste them into Client ID and Client Secret.
  8. Optionally, set Hosted Domain to your Workspace domain (e.g. yourcompany.com) to restrict sign-in to that domain only.
  9. Click Test Connection, then Save.

Setting up Azure AD / Entra ID

  1. Go to the Azure Portal  → Microsoft Entra ID → App registrations → New registration.
  2. Give it a name (e.g. qRaptor SSO), and choose the Supported account types that fit who should sign in (usually single-tenant — your organization only).
  3. Under Redirect URI, select platform Web and paste the Redirect URI you copied from qRaptor.
  4. Click Register.
  5. On the app’s Overview page, copy the Application (client) ID — this goes into qRaptor’s Client ID field — and the Directory (tenant) ID — this goes into qRaptor’s Tenant ID field.
  6. Go to Certificates & Secrets → New client secret, give it a description and expiry, and click Add.
  7. Immediately copy the secret’s Value (not the Secret ID column — the value is only shown once). This goes into qRaptor’s Client Secret field.
  8. Back in qRaptor’s dialog, paste in the Client ID, Tenant ID, and Client Secret.
  9. Click Test Connection, then Save.
ℹ️

Test Connection checks configuration format and reachability — it doesn’t fully validate OAuth until someone actually signs in through the provider after saving.

💡

Removing a provider doesn’t lock anyone out immediately — it just means users who signed in through it will need a password or another configured provider next time.

Common issues

  • SSO toggle is disabled — Requires a Pro plan or above; upgrade from the Upgrade to Pro link next to the toggle.
  • SSO sign-in fails after configuring a provider — Confirm the Redirect URI you copied matches exactly what’s registered in your identity provider’s console, then use Test Connection before relying on it in production.
Custom CSSRoles & permissions