Who is this article for?

IT Administrators implementing Single Sign-On (SSO).

IQM v7.4 and IQM Mobile v2.4.0 are required.

Ideagen Quality Management Single Sign-On (SSO) allows end users to authenticate with Windows and Web clients via Single Sign-On with Microsoft Entra ID.

This article outlines the steps required to configure Microsoft Entra for Ideagen Quality Management Single Sign-On (SSO).

We do not directly support the Entra ID. These steps are provided as a guide only to assist in the configuration. Before you begin please ensure your Ideagen Quality Management is using SSL for secure connections.

1. Creating a scope

In version 7.6.1 and above, you will be asked to enter Scope information into the system when configuring the Single Sign-On options.

Below is a table listing the different scopes for different parts of the application.

Scopes are case sensitive and need to be separated by a space when entered into the system (e.g. openid email profile)

2. Entra Portal app registration

In order for Single Sign-On (SSO) to work you will need to configure a Redirect URL via the Microsoft Entra Portal's App Registration.

The Redirect URL / Reply URL must be configured with the address where the authorised server sends the user when the app has successfully authorised access and granted an access token.

Important
All URLs and URIs are case sensitive.

3. Creating a new app

To create a new app:

1. Log in to the Entra Portal and go to App Registration.
2. Click New Registration.
3. Give the registration a clear name (e.g. QP7SSO).

4. Creating client secrets

To create client secrets:

1. Open the new application registration created.
2. Click on Certificates & Secrets.
3. Click New Client Secret.

4. Enter a new client secret.
5. Copy the client secret value (this is needed later in the Ideagen Quality Management configuration).

5. Adding API permissions

To add permissions:

1. Open the new application registration created.
2. Click on API Permissions.
3. Click Add Permission.
4. In Request API Permissions , add:

• • • email
    • profile

5. Click Add Permissions.

Important
Admin consent must be granted otherwise the users won’t be able to access email and profile graph endpoints within an Entra ID tenant.

6. Adding ID and Access Token

To add ID and Access Token:

1. Open the new application registration created.
2. Click on Token Configuration.
3. Click Add Optional Claim.
4. In Add Optional Claim, select the token type as ID.
5. Add the following claims:

• • • acct
    • email
    • family_name
    • given_name
    • Preferred_username

6. Click Add.
7. Click Add Optional Claim again.
8. In Add Optional Claim, select the token type as Access.
9. Add the following claims:

• • • acct
    • email
    • family_name
    • given_name
    • Preferred_username

10. Click Add.

Notice you will have a set of ID token claims and a set of Access token claims.

7. Adding redirect URL to authentication

7.1.1. Add Web Platform

To add a Web Platform:

1. Open the new application registration created.
2. Click on Authentication.
3. Click Add a Platform.
4. Select Web as the Platform type.

5. Set the Redirect URI to the URL of your Web interface.
   It should look like https://servername/QPulse/.

6. Select Access tokens (used for implicit flows).
7. Select ID tokens (used for implicit and hybrid flows).
8. Click Configure.
9. Click Add a Platform.
10. Click Mobile and Desktop applications.

11. Enter the custom redirect in the format of ms-appx-web://Microsoft.AAD.BrokerPlugin/<ClientID>.
12. Go to Mobile and Desktop Applications.
13. Find the Redirect URIs section.
14. Click Add URI.
15. Enter qpulsemobile://auth/.

Example
ms-appx-web://Microsoft.AAD.BrokerPlugin/2afe572e-d268-4c77-a22d-fdca617e2255.

Important
If you use multiple Ideagen Quality Management databases then additional configuration will be required to support each database. Please see the steps below.

7.1.2. Multiple Ideagen Quality Management Databases

To add additional databases:

1. Find the Redirect URIs section.
2. Click Add URI.
3. Enter the URL for each database configured in your system.

Example

• https://live.servername/Qpulse/
• https://training.servername/Qpulse/
• https://uat.servernameQpulse/

4. Click Save.

7.2.1. Add Single Page Application Platform

To add a platform:

1. Click Add a Platform.
2. Select Single Page Application.
3. Enter the Redirect URL as the Web interface URL (in the Configure Single-Page Application section).

Example
https://servername/QPulse/Authenticate.aspx

Important
If you use multiple Ideagen Quality Management databases then additional configuration will be required to support each database. Please see the steps below. Please also bare in mind that this is CASE SENSITIVE which the examples showcase.

7.2.2. Multiple Ideagen Quality Management Databases

To add additional databases:

1. Find the Redirect URIs section.
2. Click Add URI.
3. Enter the URL for each database configured in your system.

Example

• https://live.servername/QPulse/Authenticate.aspx
• https://training.servername/QPulse/Authenticate.aspx
• https://uat.servername/QPulse/Authenticate.aspx

4. Click Save.