Single Sign-On (SSO) for NebulaCRS

Introduction to SSO

Single Sign-On (SSO) is a secure authentication method that allows you to access multiple applications and systems using one set of login credentials (your company username and password).

Instead of remembering unique passwords for every service, you log in once to your company's central system (such as Microsoft or Google), and SSO handles your access across all connected platforms, including NebulaCRS.

Legacy Username and Password

The legacy username and password for eRes, NebulaCRS will still work. On the New modules, click on the HTI logo which will direct you to the screen to login with Username and password. eRes you will still need to use a username and password.

Configuration and Initial Sign-Up

The SSO process requires a one-time sign-up to link your NebulaCRS user profile with your central company login credentials.

Admin/Supervisor Setup (System Administrator Tasks)

1. Create or Update User: Create a new user or update an existing user profile within NebulaCRS. (Refer to article).
   
2. Assign Company Email: Ensure the user profile has a valid company email address assigned. This email address is the critical link for SSO.
3. Optional Invitation: Click the 'Invite User' button to send an invitation email.

End-User Sign-Up Process (User Tasks)

1. Follow Invitation: If you received an invitation email, click the link inside and select the Sign Up option.
2. Match Email: During the sign-up process, you must use your company email address that was assigned to you in NebulaCRS.
3. First Login: Once the sign-up is complete, you can log in to the connected NebulaCRS modules using the dedicated "Organisations Login" option (e.g., "Login with Google" or "Login with Microsoft").
   

Please Note

1. Email Requirement: You must have a valid company email address assigned to your NebulaCRS profile.
2. Legacy Password Requirement: A password still needs to be assigned to your user account within the NebulaCRS system. This password is required for Legacy Login modules (see supported modules below) and for Supervisor Override features. 

How SSO Works

1. User accesses the NebulaCRS application and selects the SSO login option.

2. NebulaCRS redirects the user to the SSO provider for authentication.

3. The SSO provider verifies credentials and sends an authentication token back.

4. The user is granted access to NebulaCRS (and other connected apps) without logging in again.

Security Authentication

The SSO system checks your credentials against a Central Identity Provider (IdP), such as Microsoft or Google Workspace.

To enhance security, your IdP may require extra verification steps before the token is issued. These are known as Multi-Factor Authentication (MFA) and may include:

• Two-Factor Authentication (2FA): Entering a one-time code sent to your phone or generated via an authenticator app.

• PIN or Security Questions: Answering a personal security question or entering a personal identification number.

• Device or Location Verification: Checking if you are logging in from a recognized device or location.

These steps are managed by your central IT department, not by NebulaCRS directly.

Supported CRS Modules and Legacy Access

Not all NebulaCRS applications support SSO.

NebulaCRS Login Screen

Call Center Login Screen

Booknow 2.0 Content Manager

For IT Administrators

IT administrators must apply additional permissions within the applicable central identity platform to allow the nebulaone application access.

Microsoft

Microsoft Entra ID (formerly Azure Active Directory)

Allow app nebulaone. If permission is not granted users will be presented with below message:

Further assistance refer to Microsoft Help Center

Google Workspace

Allow app nebulaone. If permission is not granted users will be presented with below message:

For further assistance refer to Google Workspace Help

Apple

Allow nebulaone access.

For further assistance refer to Apple Support

Troubleshooting