Single Sign-On (SSO) for NebulaCRS

Introduction

Configuration and Initial Sign-Up

The SSO process requires a one-time sign-up to link your NebulaCRS user profile with your central company login credentials.

Admin/Supervisor Setup (System Administrator Tasks)

1. Create or Update User: Create a new user or update an existing user profile within NebulaCRS. (Refer Knowledge Base Article).
   

2. Assign Company Email: Ensure the user profile has a valid company email address assigned. This email address is the critical link for SSO.

3. Optional Invitation: Click the 'Invite User' button to send an invitation email.

End-User Sign-Up Process (User Tasks)

1. Follow Invitation: If you received an invitation email, click the link inside and select the Sign Up option.

2. Match Email: During the sign-up process, you must use your company email address that was assigned to you in NebulaCRS.

3. First Login: Once the sign-up is complete, you can log in to the connected NebulaCRS modules using the dedicated "Organisations Login" option (e.g., "Login with Google" or "Login with Microsoft").

Please Note

• Email Requirement: You must have a valid company email address assigned to your NebulaCRS profile.

• Legacy Password Requirement: A password still needs to be assigned to your user account within the NebulaCRS system. This password is required for Legacy Login modules (see supported modules below) and for Supervisor Override features. It is NOT used for logging into the SSO-supported modules. Your SSO login is secured by your Identity Provider (e.g., Microsoft or Google).

How SSO Works

1. User accesses the NebulaCRS application and selects the SSO login option.
2. NebulaCRS redirects the user to the SSO provider for authentication.
3. The SSO provider verifies credentials and sends an authentication token back.
4. The user is granted access to NebulaCRS (and other connected apps) without logging in again.
   

Security Authentication

The SSO system checks your credentials against a Central Identity Provider (IdP), such as Microsoft Entra ID or Google Workspace.

To enhance security, your IdP may require extra verification steps before the token is issued. These are known as Multi-Factor Authentication (MFA) and may include:

• Two-Factor Authentication (2FA): Entering a one-time code sent to your phone or generated via an authenticator app.

• PIN or Security Questions: Answering a personal security question or entering a personal identification number.

• Device or Location Verification: Checking if you are logging in from a recognized device or location.

These steps are managed by your central IT department, not by NebulaCRS directly.

Supported CRS Modules and Legacy Access

Not all NebulaCRS applications support SSO.

For IT Administrators

IT administrators may need to apply additional permissions within the applicable central identity platform to allow the nebulaone application access.

Troubleshooting