Overview
Pulseway RMM supports Single Sign-On (SSO) through the OpenID Connect (OIDC) authentication protocol. This allows users to authenticate using their existing identity provider credentials, such as Microsoft Entra ID or Google, rather than maintaining separate Pulseway passwords.
Before you begin
Pulseway Administrator Access
Admin Access to your Identity provider
Permission to create and configure the application
This guide uses Microsoft Entra ID as the example identity provider. Other OIDC providers may use different terminology
Configure OpenID Connect in Pulseway
Sign in to the Pulseway WebApp with an admin account and go to Configuration > Settings > External Authentication > OpenID Connect Login Settings.
In the OpenID Connect Login Settings section, turn on the Active toggle.
3. Review the configuration and copy the Redirect URL
In the Identity Provider Configuration Information section, you will find the Redirect URL, the Post-Logout Redirect URL, and the Login URL. These fields are not editable and are provided for you to copy and paste in the corresponding settings of your IdP (Google, Microsoft, and so forth).
Redirect URL: This is the page where the authentication server sends the user once they have successfully authenticated through their identity provider.
Post-Logout Redirect URL: This is the page where you want a user to land after logging out of Pulseway.
Login URL: This link is an alternate login page that redirects users to log in via SSO, typically used as a redirect URL when configuring the IdP. Users can still log in using the default Pulseway login URL.
OIDC Settings
Username Claim: the value used by the IdP as the username. Example: Entering the value email will establish the user’s email address as their username.
Email Claim: the value from the IdP to use as the email address. Typically, this field will be set to email.
User Identifier: Identifier in the form of a claim that will be used by Pulseway to match a local account for the authenticated user. Choose between Email or Username.
Scopes: Scopes are required by the OpenID Connect provider to retrieve information about the authenticated user. Refer to your OpenID Connect provider documentation for more information about which scopes to use.
Authentication Type: This value specifies how the endpoint wants the Client ID and Client Secret sent. Choose between In HTTP Header and In Request Parameters. Refer to Authentication type best practices for more information.
Login Method Preference: The following options are available in the drop-down:
Choose Account: Allows the user to choose an account to log in with, even if already logged in.
Force Login: Requires the user to re-enter their credentials, even if already logged in.
Silent Login: Automatically logs in if the user has an active session, without showing any prompts.
Configuration on Microsoft Azure/Entra
1. Sign in to portal.azure.com (Microsoft Entra admin center) and navigate to App Registrations > New Registration.
2. Enter a name of your choice (Ex: Pulseway RMM - OIDC). Under Supported account types, select Single tenant only.
3. Add the Redirect URL from the Pulseway WebApp and then click on Register
4. Open the Application and go to Manage > Endpoints > OpenID Connect metadata document and copy the URL.
5. Create a Client Secret: Go to the App > Manage > Certificates & Secrets > Client Secrets > New Client Secret > Enter the details > Add > then Copy the Value and save.
Client Secret Value is available only once to copy.
Configuration on the Pulseway WebApp
OpenID Configuration URL – Enter the URL that is copied from Entra > App Registration > Manage > Endpoints > OpenID Connect metadata document > Copy and Paste the link.
Client ID - To get the client ID for Pulseway, login to the Microsoft Entra admin center > select the application you created for Pulseway SSO.
Paste the link under Client ID on the WebApp as below.
3. Client Secret - Copy the Value of point 5 from Configuration on Entra and paste it under the Client Secret of the WebApp.
Then save the settings.
Configure User Team Management
User Team Management syncs team groups using a custom claim in the OAuth token and creates user accounts on first login when they don’t exist.
If the option is not enabled, users retain the permissions and access rights associated with their existing Pulseway accounts.
Add the groups claim on Entra ID - Go to Entra ID > select the created Application > Manage > Token configuration > Add groups claim > ensure Security groups is selected > click on Add
Identify the security group - Open the security group you want to map to Pulseway and copy its Object ID. Ensure the user's email address is a member of the security group.
Sign in to the Pulseway WebApp through SSO with an administrator account and enable the User Team Management.
Configure the claim - under Claim Name, enter "groups"
Configure Teams Mapping - Edit Teams Mapping and map the relevant Entra ID security group.
Verify - Log out and sign in again to verify that the expected team mapping and permissions are applied.
Enforce login via SSO (Optional)
The Enforce SSO option can require users to authenticate through SSO when they log in to Pulseway.
Important
Enforce SSO can only be enabled by an administrator who is currently logged in through SSO.
Configure fallback administrator access - Before enabling enforcement, select one or more Pulseway administrator users in the Fallback Admin Accounts section. These administrators can bypass SSO and sign in using their Pulseway username and password if the SSO provider is unavailable.
After confirming that fallback access is configured, enable Enforce SSO.
