CurrentWare supports Single Sign-On (SSO) using Microsoft Entra ID through OpenID Connect (OIDC). This integration allows users to sign in to the CurrentWare Web Console using their organization's Microsoft Entra ID credentials.
This guide walks you through registering an application in Microsoft Entra ID, configuring the required authentication settings, and connecting Microsoft Entra ID to CurrentWare.
You will need:
Microsoft Entra ID administrator access
Access to the CurrentWare Web Console
Your CurrentWare OIDC Redirect URI (provided by CurrentWare)
Sign in to the Microsoft Entra Admin Center.
Go to Microsoft Entra ID → App registrations.
Click New registration.
Enter a name for the application (for example, CurrentWare OIDC).
Under Supported account types, select Accounts in this organizational directory only (Single tenant).
Click Register.
Your application is now registered in Microsoft Entra ID.
Open your newly created application.
Select Authentication.
Click Add a platform.
Select Web.
Enter the following Redirect URI:
https://cw-saas-use2-prod-customer-portal-auth.auth.us-east-2.amazoncognito.com/oauth2/idpresponse
Click Configure.
Important: The Redirect URI must match the URL provided by CurrentWare exactly, including the protocol, hostname, and path. An incorrect Redirect URI can result in an
AADSTS50011error during authentication.
While on the Authentication page, locate Implicit grant and hybrid flows.
Enable ID tokens (used for implicit and hybrid flows).
Leave Access tokens unchecked unless specifically required.
Click Save.
This setting enables ID tokens for authentication flows that require them.
In your application, select Certificates & secrets.
Select Client secrets.
Click New client secret.
Enter a description (for example, CurrentWare OIDC).
Select an expiration period (for example, 12 months, or according to your organization's security policy).
Click Add.
Copy the Value of the newly created client secret and store it securely.
Important: Microsoft Entra ID displays the Client Secret Value only once. If you leave or refresh the page without saving it, you must create a new secret.
Be sure to copy the Value, not the Secret ID. CurrentWare requires the Client Secret Value.
Open your application and select API permissions.
Click Add a permission.
Select Microsoft Graph.
Choose Delegated permissions.
Add the following permissions:
openid
profile
email
Click Add permissions.
Additional permissions, such as offline_access and User.Read, may be configured if required by your organization's authentication policies.
If required by your organization's policies, click Grant admin consent to approve the configured permissions.
CurrentWare requires three values from your Microsoft Entra ID configuration:
Application (Client) ID
Client Secret Value
Issuer URL
Find Your Application (Client) ID
In Microsoft Entra ID, go to App registrations.
Open your CurrentWare OIDC application.
Select Overview.
Copy the Application (client) ID.
This value will be used as the Client ID in CurrentWare.
Find Your Client Secret
Use the Client Secret Value saved in Step 4.
If you did not save the value when it was created, you must generate a new client secret.
Find Your Issuer URL
The Issuer URL identifies your Microsoft Entra ID tenant and is used by CurrentWare to discover the authentication endpoints.
In the Microsoft Entra Admin Center, navigate to Microsoft Entra ID → App registrations.
From the App registrations page, click Endpoints without opening an individual application.
Locate the OpenID Connect metadata document URL.
Example metadata URL:
https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
Remove /.well-known/openid-configuration from the end of the URL.
Your Issuer URL should follow this format:
https://login.microsoftonline.com/<tenant-id>/v2.0
Replace <tenant-id> with your organization's Directory (tenant) ID, which is available on your application's Overview page.
For example, if your Directory (tenant) ID is 18354e3d-8d1c-42d0-9e50-2a4780cca881, your Issuer URL would be:
https://login.microsoftonline.com/18354e3d-8d1c-42d0-9e50-2a4780cca881/v2.0
Important: Use your organization's actual Directory (tenant) ID. Do not use the example value shown above.
Sign in to the CurrentWare Web Console.
Navigate to Administration → Single Sign-On (SSO).
Configure the following settings:
| Setting | Value |
|---|---|
| Provider | OIDC |
| Enable SSO | Enabled |
| Client ID | Application (client) ID from Microsoft Entra ID |
| Client Secret | Client Secret Value from Microsoft Entra ID |
| Authorized Scopes | openid email profile |
| Endpoint Discovery | Automatic (Issuer URL) |
| Issuer URL | Your Microsoft Entra ID Issuer URL |
Click Save to apply the configuration.
After saving the configuration, test the integration to confirm that users can authenticate successfully.
Open a new Incognito or InPrivate browser window.
Navigate to your CurrentWare login page.
Click Sign in with SSO.
Sign in using your Microsoft Entra ID credentials.
Confirm that you are redirected back to the CurrentWare Web Console and successfully signed in.
If authentication completes successfully, your Microsoft Entra ID SSO integration is configured.
AADSTS50011 – Redirect URI mismatch: Verify that the Redirect URI configured in Microsoft Entra ID matches the URL provided by CurrentWare exactly.
Invalid Client Secret: Confirm that you entered the Client Secret Value, not the Secret ID. Check whether the secret has expired.
Authentication fails or the identity provider cannot be reached: Verify that the Issuer URL contains the correct Directory (tenant) ID and ends with /v2.0.
User cannot sign in: Confirm that the user has access to the application in Microsoft Entra ID and that any required administrator consent has been granted.
SSO option does not appear in CurrentWare: Verify that SSO is enabled and the OIDC configuration has been saved.
Tags: Cloud, SSO, Microsoft Entra ID, OIDC, Authentication, Integrations