Single Sign-On (SSO)

FIXSIM Enterprise lets your team sign in to portal.fixsim.com with your company identity provider using OpenID Connect (OIDC). This page covers what FIXSIM needs, how to register FIXSIM in Microsoft Entra ID or Okta, how to finish the setup in the FIXSIM portal, and how to roll SSO out to a team that already uses FIXSIM.

Single sign-on is included in the Enterprise plan. If your firm is on another plan and your IT team requires SSO, contact FIXSIM and we will set it up as part of an Enterprise upgrade.

On this page: What you get · Values FIXSIM needs · Values your provider needs · Entra ID · Okta · Other providers · Finishing the setup · Rolling out to a team · Account matching · Secret expiry · Troubleshooting · Security notes

What you get

• Users sign in at portal.fixsim.com by clicking Sign in with single sign-on (SSO) and entering their work email. FIXSIM sends them to your identity provider and back.
• A person who signs in through SSO for the first time gets a FIXSIM account automatically (just-in-time provisioning) under your firm, with the role you choose. No invitation is needed.
• Optionally, you can require SSO for your email domains. Password login and password reset are then refused for your users, who are sent to your identity provider instead.
• Disabling a user at your identity provider blocks new FIXSIM sign-ins for that user. Existing FIXSIM sessions end when they expire or when the user signs out.

Not included in this release: SAML, SCIM provisioning and deprovisioning, and group-to-role mapping. Roles are managed on the Users page.

Values FIXSIM needs from you

Item	Where to find it
Authority (issuer URL)	Entra ID: https://login.microsoftonline.com/<tenant-id>/v2.0. Okta: https://<your-domain>.okta.com or your custom authorization server URL.
Client ID	The application (client) id of the app registration you create below.
Client secret	Generated in the app registration. FIXSIM stores it encrypted.
Allowed email domains	The email domains your users sign in with, for example yourfirm.com; yourfirm.co.uk.

Values your identity provider needs from FIXSIM

Open Setup → Single Sign-On in the FIXSIM portal (visible to ClientAdmin users on Enterprise plans). The page shows the exact values for your firm. They are:

Item	Value
Redirect URI (reply URL)	https://portal.fixsim.com/signin-oidc/<your-firm-id> as shown on the page
Platform / application type	Web
Flow	Authorization code with PKCE and a client secret, response mode form_post
Scopes	openid profile email
Claims FIXSIM reads	email (or preferred_username / upn), name, given_name, family_name, sub
Sign-out	Not used. Signing out of FIXSIM does not sign the user out of your identity provider.

Microsoft Entra ID

1. In the Entra admin center (entra.microsoft.com), open Entra ID → App registrations (older layouts: Identity → Applications → App registrations) and choose New registration.
2. Name it FIXSIM. Under Supported account types choose Accounts in this organizational directory only (single tenant).
3. Under Redirect URI choose Web and paste the Redirect URI from the FIXSIM Single Sign-On page. Register.
4. On the Overview page copy the Application (client) ID and the Directory (tenant) ID.
5. Open Certificates & secrets, choose New client secret, set an expiry that matches your policy (24 months is the maximum Entra allows), and copy the Value immediately (it is shown once). Note the expiry date. Entra secrets always expire and Entra does not warn you. Enter the date in FIXSIM's Secret expires on field so FIXSIM can email your administrators 30 days, 7 days and 0 days before, and set a calendar reminder of your own.
6. Open Authentication. Under Implicit grant and hybrid flows leave both boxes unchecked. Under Advanced settings, Allow public client flows should be No.
7. Open Token configuration, choose Add optional claim, token type ID, and add email, given_name, family_name, and upn. Accept the prompt to add the corresponding Microsoft Graph permissions. This makes sure the email claim is present even for users whose sign-in name differs from their mail address.
   If your FIXSIM users are external identities in this tenant (their user principal name contains #EXT#), add email, given_name and family_name but not upn, and make sure each user's Email property is set. FIXSIM reads email first and upn before preferred_username, so an #EXT# upn would be refused as an unknown domain.
8. Open API permissions. Confirm openid, profile, email, and User.Read are listed under Microsoft Graph. If your tenant requires admin consent, choose Grant admin consent.
9. Optional: open Enterprise applications → FIXSIM → Properties and set Assignment required to Yes, then assign the users or groups who may use FIXSIM. Anyone not assigned will be refused by Entra before reaching FIXSIM.

In FIXSIM, enter:

• Authority: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0
• Client ID: the Application (client) ID
• Client secret: the secret value from step 5

Do not use the common or organizations authority; FIXSIM validates the issuer against your tenant.

Okta

1. In the Okta admin console open Applications → Applications and choose Create App Integration.
2. Sign-in method OIDC - OpenID Connect, application type Web Application. Next.
3. Name it FIXSIM. Grant type: Authorization Code only (leave Refresh Token and Implicit unchecked).
4. Sign-in redirect URIs: paste the Redirect URI from the FIXSIM Single Sign-On page. Leave sign-out redirect URIs empty.
5. Assignments: choose the groups or users who may sign in to FIXSIM. Save.
6. On the app's General tab copy the Client ID and the Client secret.
7. Confirm the app uses Client authentication: Client secret and that Proof Key for Code Exchange (PKCE) is allowed (it is the default for web apps).

In FIXSIM, enter:

• Authority: https://<your-domain>.okta.com for the org authorization server, or https://<your-domain>.okta.com/oauth2/<server-id> if you use a custom authorization server
• Client ID and Client secret from step 6

Okta returns email, given_name, and family_name with the profile and email scopes by default.

Other OpenID Connect providers

Any provider that supports the authorization code flow with discovery (/.well-known/openid-configuration) works. Register a web application with the Redirect URI shown in FIXSIM, grant the openid profile email scopes, and make sure the ID token or userinfo response carries the user's email.

Finishing the setup in FIXSIM

1. Sign in to portal.fixsim.com as a ClientAdmin and open Setup → Single Sign-On.
2. Enter the Authority, Client ID, Client secret, and your Allowed email domains.
3. Choose the Role for new users. PowerUser is a good default: they can configure sessions and rules but not manage users. Change individual users later on the Users page.
4. Choose Test connection. FIXSIM fetches your provider's discovery document and reports the issuer, endpoints, and signing keys it found.
5. Tick Enabled and Save.
6. FIXSIM verifies that your firm owns the email domains you listed and approves them, normally within one business day. The page shows Awaiting FIXSIM verification until then and Domains verified by FIXSIM afterwards. SSO sign-in does not start before approval. If you later change the domain list, it needs a fresh verification.
7. Sign out, open the login page, choose Sign in with single sign-on (SSO), enter your work email, and complete the sign-in at your provider. You should land on the FIXSIM dashboard.
8. Only after your own SSO sign-in works, tick Require SSO if you want password login refused for your domains. This setting affects every user in your firm whose email is in the allowed domains.

Rolling SSO out to an existing team

If your firm already uses FIXSIM with password logins, nothing has to be migrated. This is the order that works well for a team of any size.

Week 0: prepare

1. Ask FIXSIM to enable Single Sign-On for your firm. SSO is part of the Enterprise plan; if you are on another plan, FIXSIM will quote the upgrade at the same time. If your firm does not yet use FIXSIM's user roles (ClientAdmin, PowerUser, User), ask for that as well so you can choose which role new SSO users receive and change roles later on the Users page.
2. Decide who your FIXSIM administrators are. They will own the SSO settings and are the people FIXSIM emails about the client secret.
3. Compare the email addresses on your FIXSIM Users page with the addresses your identity provider will send (the primary email or user principal name). They must match exactly for an existing user to be recognized. Fix any mismatch before you start, otherwise that person gets a second FIXSIM account on first SSO sign-in and takes a seat.

Week 1: connect, but do not require

4. Register FIXSIM at your identity provider (Entra ID or Okta sections above) and fill in the Single Sign-On page. Test connection, tick Enabled, Save. Leave Require SSO off.
5. FIXSIM verifies your domains. The page shows Domains verified by FIXSIM when done.
6. A FIXSIM administrator signs in through SSO once to confirm it works end to end.
7. Tell your team: "FIXSIM now supports SSO. Next time you log in, click Sign in with single sign-on and use your work account." Each person is linked to their existing FIXSIM account on that first SSO sign-in and keeps their role and settings. Passwords keep working during this period, so nobody is blocked.

Week 2 or later: require SSO

8. Check on the Users page that your active users have signed in through SSO at least once. FIXSIM can tell you who has not.
9. Tick Require SSO and Save. From now on password login and password reset are refused for your email domains. New hires get a FIXSIM account automatically on their first SSO sign-in with the role you chose.

Afterwards

• New joiners: nothing to do in FIXSIM. They sign in and get the default role. If your FIXSIM seat limit is reached they see a message asking you for more seats, and FIXSIM support is notified.
• Leavers: disabling the person at your identity provider blocks new FIXSIM sign-ins immediately. Their FIXSIM seat stays allocated until you remove them on the Users page, since FIXSIM does not receive deprovisioning events from your provider in this release.
• Client secret: enter its expiry date on the Single Sign-On page. FIXSIM emails your administrators 30, 7 and 0 days before it lapses. See When the client secret expires below.

How accounts are matched

• A returning SSO user is matched by the identity your provider sends (the sub claim), so email changes at the provider do not create duplicate accounts.
• A user who already has a FIXSIM account in your firm (for example, someone invited earlier) is linked to their SSO identity on first SSO sign-in and keeps their existing role.
• A free-trial FIXSIM account with an email in your domains is moved into your firm on first SSO sign-in.
• An account that belongs to a different FIXSIM customer is never touched. The sign-in is refused and the user is asked to contact FIXSIM Support.
• The email your provider returns must be in your Allowed email domains. Otherwise the sign-in is refused.
• SSO users count toward your FIXSIM user limit exactly like invited users.

When the client secret expires (Entra ID)

If the secret lapses before it is replaced, SSO sign-ins fail with "your organization's single sign-on secret was rejected". FIXSIM immediately emails your ClientAdmins and FIXSIM support. To recover:

1. Create a new client secret in the FIXSIM app registration in Entra.
2. Sign in to portal.fixsim.com. If your firm requires SSO, your ClientAdmins can sign in with their password for 72 hours after the first failed sign-in, precisely so they can do this step.
3. Open Setup → Single Sign-On, paste the new secret, update Secret expires on, and Save. SSO works again immediately.

Okta and most other providers do not expire client secrets, so this section does not apply to them.

Troubleshooting

Symptom	Likely cause
"Single sign-on is not set up for your domain"	The domain is not in Allowed email domains, the domains are still awaiting FIXSIM verification, SSO is not Enabled, or your plan does not include SSO.
Provider shows an error about the redirect URI	The Redirect URI in the app registration does not match the value on the FIXSIM Single Sign-On page exactly.
"The sign-in response could not be validated"	The Authority does not match the tenant that issued the token. Run Test connection and check the tenant id.
"Your organization's single sign-on secret was rejected"	The client secret is wrong or has expired. See When the client secret expires above.
"Your identity provider did not return an email address"	Add the email optional claim (Entra ID) or check the email scope on the app.
"User limit has been reached"	Contact FIXSIM to add seats, or remove unused users on the Users page. FIXSIM is notified automatically when this happens.

Security notes

• The client secret is encrypted at rest with keys held by FIXSIM and is never shown again after saving.
• Each firm has its own redirect URI. FIXSIM only accepts sign-in responses for the firm the login started with.
• FIXSIM validates the ID token signature, issuer, audience, expiry, nonce, and state on every sign-in.

Roles, seats, and instance access for the accounts SSO creates are managed on the Managing Users & Roles page. Questions about your firm's setup: contact FIXSIM support.