> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attention.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> How to setup Single Sign-On for your org.

Attention supports Single Sign-On through Google, Okta, and Microsoft EntraID.

## **Google SSO Setup**

1. Go to the Google Cloud Platform and choose your project: [https://console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials)
2. Click on `+ Create Credentials` and choose `OAuth client ID`
3. Choose `Web application` as application type and give a name.
4. Under `Authorized Redirect URIs`, paste the following URI:

[https://id.attention.tech/ui/login/login/externalidp/callback](https://id.attention.tech/ui/login/login/externalidp/callback)

<img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/GoogleAauthClientID.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=23356f9376ea77828b273913bcf007dd" alt="Google Aauth Client ID Pn" title="Google Aauth Client ID Pn" style={{ width:"75%" }} width="1482" height="1512" data-path="images/GoogleAauthClientID.png" />

5. After saving, a **Client ID** and **Client Secret** will be generated. Provide these to your Attention point of contact to finalize setup.
6. After doing this, the Attention team will follow up with the URL your team needs to use log in with Google OAuth. This URL will take you directly to your Google account login. Once you log in successfully, you will be redirected automatically to the Attention paltform homepage.

<Info>
  NOTE: The authentication mechanism does not auto provision users on Attention. Users must be invited to Attention before trying to authenticate via Google.
</Info>

## **Okta SSO Setup**

1. As an Okta administrator, log into the administration panel and navigate to the list of applications.
2. Once there, click to create a new App Integration, and choose `OIDC - OpenID Connect`.
3. Choose `Web Application` as the application type.

<img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/OktaWebAppIntegration.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=7241f054b4db382bb4c18ec793199be4" alt="Okta Web App Integration Pn" width="1600" height="902" data-path="images/OktaWebAppIntegration.png" />

4. Give it an identifiable name (this is for your own purposes to easily identify it among other applications you might have configured).
5. In the `Sign-in redirect URIs` paste the identity service redirect URL which is the following one: [https://id.attention.tech/ui/login/login/externalidp/callback](https://id.attention.tech/ui/login/login/externalidp/callback)
6. Once saved, provide the **Client ID, Secret and Issuer URL** (which will look something like: [https://trial-1925566.okta.com](https://trial-1925566.okta.com)) to your point of contact at Attention. Your Attention point of contact will then notify you once the configuration has been completed.
7. Once the Web Application has been created, add your team members to organization and/or group in Okta that is configured to use this new application.

## **EntraID SAML Setup**

**Register a new enterprise application in EntraID**

1. Navigate to the [Enterprise App registration menu](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AppGalleryBladeV2).
2. Search for "SAML Toolkit" and click on the `Microsoft Entra SAML Toolkit` card.
3. Change the name if desired and click "Create"

<img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/MicrosoftEntraSAMLToolkit.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=89505c3390cd083f5b86b9ab077e8e7f" alt="Microsoft Entra SAML Toolkit Pn" width="2048" height="1070" data-path="images/MicrosoftEntraSAMLToolkit.png" />

4. This will create an application that will be configured in the subsequent steps.

<img src="https://mintlify.s3.us-west-1.amazonaws.com/attentiontech/EntraIDEnterpriseApplications.png" alt="EntraID Enterprise Applications.png" />

### **Configure SAML**

1. Click on the Application and Go to `Manage`> `Single sign-on`
2. Select SAML

   <img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/EntraIDSelectSAML-1.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=ff0425dc36364ee81ccdf896ee3c65e7" alt="Entra ID Select SAML 1 Pn" width="2048" height="1133" data-path="images/EntraIDSelectSAML-1.png" />
3. Once redirected to the Single Sign-On details, copy the URL from `SAML Certificates` > `App Federation Metadata URL` to your clipboard

   <img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/EntraIDCopyURL.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=b73d8c9736a5867bfb079c3f1c30e4f4" alt="Entra ID Copy URL Pn" width="2048" height="1217" data-path="images/EntraIDCopyURL.png" />

   The URL will look like the following:

   [https://login.microsoftonline.com/a58a822e-34bf-4955-b034-000000000/federationmetadata/2007-06/federationmetadata.xml?appid=3e1dde4d-f7b2-4836-000-00000000](https://login.microsoftonline.com/a58a822e-34bf-4955-b034-000000000/federationmetadata/2007-06/federationmetadata.xml?appid=3e1dde4d-f7b2-4836-000-00000000)
4. Provide this URL to your point of contact at Attention.
5. The Attention team will then provide a series of URLs like the following:

> Entity ID URL: [https://id.attention.tech/idps/00000000000000000000/saml/metadata](https://id.attention.tech/idps/00000000000000000000/saml/metadata) Reply URL: [https://id.attention.tech/ui/login/login/externalidp/saml/acs](https://id.attention.tech/ui/login/login/externalidp/saml/acs) \
> Sign On URL: [https://id.attention.tech/ui/login/login/externalidp/saml/acs](https://id.attention.tech/ui/login/login/externalidp/saml/acs) \
> Logout URL: [https://id.attention.tech/idps/00000000000000000000/saml/slo](https://id.attention.tech/idps/00000000000000000000/saml/slo)

6. Return to the `Single sign-On` settings of your application and click Edit on `Basic SAML Configuration`

<img src="https://mintlify.s3.us-west-1.amazonaws.com/attentiontech/images/EntraIDBasisSAMLConfiguration.png" alt="Entra ID Basis SAML Configuration Pn" />

7. Paste in the URLs provided by the Attention team to each matching field. Leave `Relay State URL` empty.

   <img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/EntraIDCopySAMLUrls.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=f2dbc5c39dfeafd697f3ceeb79e9b3db" alt="Entra ID Copy SAML Urls Pn" width="1636" height="1584" data-path="images/EntraIDCopySAMLUrls.png" />
8. Save changes and confirm your `Basic SAML Configuration` section now looks like this:

<img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/ConfirmSAMLURLs.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=8db4500db102560b95f0f107971acf9c" alt="Confirm SAMLUR Ls Pn" width="1548" height="678" data-path="images/ConfirmSAMLURLs.png" />

9. Once completed, notify your Attention point of contact.
10. The Attention team will follow up provide the URL needed to log in using EntraID. This URL will take you directly to your EntraID login. Once users login, they will be redirected to the Attention homepage.

<Info>
  NOTE: The authentication mechanism does not auto-provision users on Attention. Users must be invited to Attention before trying to authenticate via EntraID.
</Info>

### Configure User Requirements for App Access

There are 2 options for requiring Attention users to authenticate via EntraID.

**Option 1:** Assign users and groups manually via the settings in `Manage` > `Users and groups`

\*\*Option 2: \*\*Require all Attention users to authenticate by default. \
To do this, naviagate to `Manage` > `Properties` and set `Assignment required?` to "No"

<img src="https://mintcdn.com/attentiontech/jNoyicKetpNuqepA/images/SAMLAssignmentRequired.png?fit=max&auto=format&n=jNoyicKetpNuqepA&q=85&s=0ac67560475cace99a5f3dc18ef64199" alt="SAML Assignment Required Pn" width="2048" height="1628" data-path="images/SAMLAssignmentRequired.png" />