<%NUMBERING1%>.<%NUMBERING2%>.<%NUMBERING3%> PRTG Manual: Single Sign-On

SSO Login

Define if you want to enable login via SSO:

• Disable (default)
• Enable

Provider

This setting is only visible if you select Enable above. Select an SSO provider from the dropdown list:

• Azure Active Directory: Use Azure Active Directory as the SSO provider.
• Okta: Use Okta as the SSO provider.

Configuration Endpoint

This setting is only visible if you select Enable above. Enter the configuration endpoint URL.

Click Load Configuration to automatically fill in the values for Authorization Endpoint, Token Endpoint, JSON Web Key Set (JWKS) URI, and Issuer. If this does not work, then manually enter the values.

Azure AD URL format example:

https://login.microsoftonline.com/<tenant-ID>/v2.0/.well-known/openid-configuration

Make sure to replace <tenant-ID> with the directory (tenant) ID from Azure AD.

Okta URL format example:

https://<your-Okta-domain>/oauth2/<authorization-server-ID>/.well-known/oauth-authorization-server

You can find the URL in the field Metadata URI under Security | API in the Okta administrator console.

Authorization Endpoint

This setting is only visible if you select Enable above. Enter the entire endpoint URL for authorization purposes, not only the server part.

Azure AD example:

https://login.microsoftonline.com/<tenant-ID>/oauth2/v2.0/authorize

Make sure to replace <tenant-ID> with the directory (tenant) ID from Azure AD.

Okta example:

https://<your-Okta-domain>/oauth2/default/v1/authorize

Make sure to replace <your-Okta-domain> with the Okta domain of your application from the Okta administrator console.

Token Endpoint

This setting is only visible if you select Enable above. Enter the entire token endpoint URL, not only the server part.

Azure AD example:

https://login.microsoftonline.com/<tenant-ID>/oauth2/v2.0/token

Make sure to replace <tenant-ID> with the directory (tenant) ID from Azure AD.

Okta example:

https://<your-Okta-domain>/oauth2/default/v1/token

Make sure to replace <your-Okta-domain> with the Okta domain of your application from the Okta administrator console.

JSON Web Key Set (JWKS) URI

This setting is only visible if you select Enable above. Enter the URI of the JWKS, not only the server part.

Azure AD example:

https://login.microsoftonline.com/<tenant-ID>/discovery/v2.0/keys

Make sure to replace <tenant-ID> with the directory (tenant) ID from Azure AD.

Okta example:

https://<your-Okta-domain>/oauth2/default/v1/keys

Make sure to replace <your-Okta-domain> with the Okta domain of your application from the Okta administrator console.

Issuer

This setting is only visible if you select Enable above. Enter the SSO issuer.

Azure AD example:

https://login.microsoftonline.com/<tenant-ID>/v2.0

Make sure to replace <tenant-ID> with the directory (tenant) ID from Azure AD.

Okta example:

https://<your-Okta-domain>/oauth2/default

Make sure to replace <your-Okta-domain> with the Okta domain of your application from the Okta administrator console.

Scope

This setting is only visible if you select Enable above. Enter the scope for SSO.

Azure AD example:

openid profile offline_access email api://<client-ID>/<scope-name>

Make sure to replace <client-ID> with the application (client) ID from Azure Active Directory and the <scope-name> with a scope name.

Okta example:

openid offline_access email profile

Application (Client) ID

This setting is only visible if you select Enable above. Enter the application (client) ID from Azure AD or the Client ID of your application from the Okta administrator console.

Client Secret

This setting is only visible if you select Enable above. Enter the client secret to verify the integrity of the SSO token.

Group Claim Retrieval

This setting is only visible if you select Azure Active Directory above. Select if you want to use an access token or GraphQL to retrieve the group claims from Microsoft Graph.

• Access token (default)

• GraphQL

If you select GraphQL to retrieve the group claims, PRTG automatically adds user.read to the scope.
If you select GraphQL and log in for the first time, a window opens and asks for the needed permissions. Click Accept to grant the permissions.

Endpoint Handling

This setting is only visible if you select Enable above. Define whether to select the callback from a list of callbacks or to manually enter a callback:

• Select from a list of endpoints (default): Select an endpoint from a list of available endpoints.
• Manually enter a URL: Manually enter an endpoint URL below.
  You need to enter a manual callback if you access PRTG via a different DNS name. For example, if you access PRTG via myPRTG.example.com but the actual DNS name of the PRTG core server is myPRTG.internal.example.com, you need to enter a manual callback.

Available Callback URLs

This setting is only visible if you select Enable and select Select from a list of endpoints (default) above. This list shows the available callbacks of this PRTG instance. Select the callbacks that your users use to connect to PRTG.

If you define an HTTPS endpoint in this field, you need to configure the HTTPS endpoint as a valid redirection URI in your SSO provider's settings.

External Callback URL

This setting is only visible if you select Enable and select Manually enter a URL above. If you access PRTG via a different DNS name, define the HTTPS endpoint.

This is necessary if the DNS name that you configured under Setup | System Administration | User Interface does not appear in the Available Callback URLs list. For example, if you access PRTG via myPRTG.example.com but the actual DNS name of the PRTG core server is myPRTG.internal.example.com, then enter myPRTG.example.com. Also make sure to add the port used by PRTG for HTTPS and the endpoint in the URL, for example: myPRTG.example.com:PORT/cb.

If you define an HTTPS endpoint in this field, you need to configure the HTTPS endpoint as a valid redirection URI in your SSO provider's settings.

Available Callback URLs (for reference)

This setting is only visible if you select Enable and select Manually enter a URL above. This list shows the available callbacks URLs of this PRTG instance for reference purposes.

Test Single Sign-On Authorization Endpoint

Click Test Single Sign-On Authorization Endpoint to call the authorization endpoint to check if starting the single sign-on process will succeed.

In case of errors, check the answer from the endpoint.