Ninecore ERP

SSO & SCIM Setup Guide

For your IT department, to connect your own identity provider and (optionally) automate user provisioning.

What this version supports — please read before you start

Prerequisites

Microsoft Entra ID (Azure AD)

App registration (for SSO login)

  1. Entra admin center → App registrations → New registration.
  2. Under Redirect URI, choose Web and paste the Redirect URI shown on Ninecore's SSO & SCIM page.
  3. After creation, note the Application (client) ID and Directory (tenant) ID from the Overview page.
  4. Certificates & secrets → New client secret — copy the value immediately, it's only shown once.
  5. API permissions → add Microsoft Graph delegated permissions openid, email, profile (these are usually present by default).
  6. Your Issuer / discovery URL for Ninecore is: https://login.microsoftonline.com/<tenant-id>/v2.0

Provisioning (for SCIM, separate from the above)

  1. Go to Enterprise Applications → find (or create) the application → Provisioning.
  2. Set mode to Automatic. Tenant URL = Ninecore's SCIM Endpoint URL. Secret Token = the bearer token generated on Ninecore's SSO & SCIM page.
  3. Test connection, then turn provisioning on. Assign the users/groups who should get accounts — group membership only controls who gets provisioned, it does not grant them any Ninecore permissions (see the scope note above).

Okta

App integration (for SSO login)

  1. Admin console → Applications → Create App Integration → sign-in method OIDC – OpenID Connect, application type Web Application.
  2. Sign-in redirect URI = Ninecore's Redirect URI.
  3. Note the Client ID and Client secret from the app's General tab.
  4. Your Issuer / discovery URL is your Okta domain, e.g. https://your-org.okta.com (or an Authorization Server's issuer if you use custom ones).
  5. Assign the people/groups who should have access under the app's Assignments tab.

Provisioning (for SCIM)

  1. On the same app, open the Provisioning tab → Configure API Integration.
  2. Base URL = Ninecore's SCIM Endpoint URL. API Token = the bearer token from Ninecore's SSO & SCIM page.
  3. Enable Create Users, Update User Attributes, and Deactivate Users (there's no Group push to enable — Groups aren't supported).

Google Workspace

OAuth client (for SSO login)

  1. Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID → type Web application.
  2. Authorized redirect URIs = Ninecore's Redirect URI.
  3. Note the generated Client ID and Client secret.
  4. Your Issuer / discovery URL is: https://accounts.google.com
  5. If your app is Internal to your Workspace domain, only your organization's users can sign in with it — the usual choice for this kind of internal-tool SSO.

Note: Google Workspace has no native SCIM provisioning for third-party applications like this one. Use JIT provisioning instead (Ninecore auto-creates an account the first time someone signs in), or have a Ninecore admin create accounts manually.

Generic / any OIDC-compliant provider

Any provider that publishes a standard OIDC discovery document works the same way: register a Web/Confidential OAuth client, set the redirect URI to Ninecore's Redirect URI, and enter your provider's discovery URL as the Issuer field (usually ending in /.well-known/openid-configuration once Ninecore appends it — just enter the base issuer URL, not the full discovery path). Request the openid, email, and profile scopes.

Configuring Ninecore ERP

In Ninecore, go to Admin → SSO & SCIM:

FieldWhat to enter
Enable SSOTurns the section on. Nothing else takes effect until this is checked.
Redirect URIRead-only — copy this into your identity provider's app registration (see above).
Issuer / discovery URLFrom your provider, per the sections above.
Client ID / Client secretFrom your provider's app registration.
Email domainYour company's email domain (e.g. acme.com) — routes users to your identity provider when they click "Log in with SSO".
Auto-create accounts (JIT)If on, a person's Ninecore account is created automatically the first time they sign in via SSO, with no modules assigned yet. If off, an admin must create their account first.
Require SSOIf on, password login is blocked for everyone except break-glass-exempt accounts (see below). Ninecore won't let you turn this on until at least one working break-glass account exists.

Break-glass accounts

A break-glass account is a normal Ninecore admin account with "SSO exempt" checked (Team management → edit the person) and MFA already set up. If your identity provider is ever unreachable and SSO is required, this is the one account that can still sign in with a password, so you're never completely locked out of your own system.

Recommendation: set up at least two break-glass-exempt admin accounts, held by different people, before turning on "Require SSO." Every break-glass sign-in is recorded in the Audit Trail, so using one when it isn't a real emergency is visible.

SCIM setup

SCIM requires SSO to already be enabled. On the SSO & SCIM page, check Enable SCIM, then click Generate new bearer token — the token is shown exactly once, so copy it immediately into your identity provider's provisioning settings (see the provider-specific sections above for where that field lives). Generating a new token immediately invalidates whatever token was configured before.

OperationWhat happens in Ninecore
Create userNew account, no modules assigned yet — a Ninecore admin assigns access afterward.
Update user (name/email)Updates the matching fields on the existing account.
Deactivate / Delete userAccount is disabled (can no longer log in). Not a permanent delete — their historical records stay intact, and re-provisioning the same email later reactivates the same account.
Group pushNot supported — nothing happens; Ninecore doesn't advertise Groups as a supported resource type to your identity provider.

Troubleshooting

"SSO isn't set up for this email address's domain" — the email's domain doesn't match what's configured in Email domain, or SSO isn't enabled yet. Double-check both.

Redirect URI mismatch / "invalid redirect_uri" from your identity provider — the single most common setup mistake. The Redirect URI in your provider's app registration must match Ninecore's Redirect URI field exactly, including https:// and no trailing slash.

"No account exists" after signing in — JIT provisioning is off and no admin has created this person's account yet. Either create it manually or turn on Auto-create accounts.

Sign-in fails with a token/clock error — usually means the server's clock and your identity provider's clock have drifted apart. This is rare with cloud identity providers but worth checking if nothing else explains a failure.

Still stuck? Contact your Ninecore ERP support contact with the exact error message shown.