Single Sign-On with OpenID Connect

Let users sign in to GlobalForms with your organization's identity provider using OpenID Connect (OIDC). Users select a sign-in button, authenticate with the provider, and return to GlobalForms signed in.

Supported identity providers

GlobalForms works with identity providers that support the OpenID Connect authorization code flow. Step-by-step guides are available for:

• Microsoft Entra ID (Azure AD)

• Okta

• Duo

• Google

Each GlobalForms server connects to one identity provider.

How it works

1. The user selects the single sign-on button on the GlobalForms sign-in page.

2. GlobalForms sends the user to the identity provider to sign in.

3. The provider returns the user to GlobalForms at /oidc/callback.

4. GlobalForms reads the user's email address from the provider and finds the GlobalForms user record with the same email. The match ignores upper and lower case.

5. GlobalForms signs the user in with that account's roles and permissions.

Before you begin

• Administrator access to your identity provider.

• GlobalForms running over HTTPS, with its public address set in domain. See Configuring HTTPS.

• Access to config\local.json on the GlobalForms server.

• A GlobalForms user resource containing your users' email addresses.

Step 1: Register GlobalForms with your identity provider

In your identity provider's admin console, create an application with these settings. The provider guides above show the exact steps.

When the application is created, record its client ID, client secret and issuer URL.

Issuer URL by provider

Step 2: Configure GlobalForms

1. Add an oidc section to config\local.json:

   JSON

   {
     "oidc": {
       "issuer": "https://login.microsoftonline.com/<tenant-id>/v2.0",
       "clientId": "<Client ID>",
       "clientSecret": "<Client secret>",
       "redirectUrl": "https://forms.example.com/oidc/callback"
     }
   }
   

2. Restart the GlobalForms service.

Step 3: Add the sign-on button to the sign-in page

The GlobalForms sign-in page shows the User Login form (path user/login). Add the single sign-on button to that form. A sign-on button on any other form doesn't start sign-in; to start sign-in from elsewhere, use a link (see Starting sign-in from a link).

1. Open the User Login form and select the Edit Form tab.

2. Add a Button component labeled, for example, Sign in with Microsoft.

3. On the button's Display tab, set Action to Submit, and in Button Custom Logic enter:

   data.name="oidc";
   data.password="oidc";
   data.oidc=true
   

   This fills the required Name and Password fields with placeholders, so the button can submit, and marks the submission as a single sign-on request.

4. On the button's API tab, set Property Name to oidc. Save the component, then save the form.

5. Select the Form Actions tab and add the OIDC Login action:

   • Resources: the user resource or resources that hold your users.

   • Trigger this action only if field: choose your sign-on button, then Equals, and enter true.

6. Edit the existing Login action. Under Trigger this action only if field, choose the sign-on button, then Not Equal, and enter true. This keeps name-and-password sign-in working alongside single sign-on.

7. Save each action.

Step 4: Test

1. Open the GlobalForms sign-in page in a private browser window.

2. Select the single sign-on button and sign in at your provider.

3. Confirm you return to GlobalForms signed in as the matching user.

4. Also confirm that signing in with a name and password still works.

Starting sign-in from a link

You can also start single sign-on from a link, for example on a portal page:

https://forms.example.com/oidc?returnUrl=https://forms.example.com/view/%23!/form/<form ID>

Troubleshooting

Each provider guide has a troubleshooting table for that provider's own error messages.

Related pages

• Setting Up Google Sign-In (OIDC)

• Setting Up Microsoft Entra ID Sign-In (OIDC)

• Setting Up Okta Sign-In (OIDC)

• Setting Up Duo Sign-In (OIDC)

• Configuring HTTPS

• Configuration Files