Single Sign-On (SSO)

InfoGenesis POS can integrate with any identity provider supported by Microsoft Azure AD B2C. Multiple identity providers can be added for a customer and for each identity provider, a user flow must be created in Azure AD B2C.

A user flow is a predefined sequence of steps that guide the authentication process for a user in an application. It allows properties to customize how their users must interact with our products when signing in (for example, MFA). Customers can also opt to enforce signed requests based on public keys, if preferred. This feature will be enabled at the customer level and will be applicable to all enterprises.

The following integrations are supported:

  • SAML-based Identity Providers - Any provider that supports SAML protocol for authentication

  • OAuth-based Identity Providers - Any provider that supports OAuth protocol for authentication

  • Local Account - User account managed directly by Azure AD B2C

  • Social Media Account - Google, Facebook, LinkedIn, and so on

OAuth

The property must provide the following information to Agilysys:

  • OIDC Discovery End point (Metadata URL)

  • Client ID

  • Client Secret

The property must obtain the following information from Agilysys:

  • Protocol (OpenID Connect)

  • Resource Scopes (Email, profile, openid)

  • Response Type (Code)

  • Response Mode (form_post)

  • Grant Type (Authorization Code, Implicit, Client Credential)

  • Redirect URL

  • Claims Mapping (Sub, email, family_name, given_name)

SAML

The property must provide the following information to Agilysys:

  • Identifier or App Name (In case of Azure AD, it is the Identifier (Entity ID))

  • Secret Value

  • Secret ID

  • App Federation Metadata URL or XML Document

Attributes and custom claims such as the following must have been configured in the customer’s identity provider and the same must be shared with Agilysys.

  • givenname

  • surname

  • emailaddress

  • name

The property must obtain the following information from Agilysys:

  • Identifier (Entity ID)

  • Reply URL (Assertion Consumer Service URL)

Local Account

Properties who do not manage an AD but would prefer to use the authentication system provided by Microsoft can use Azure AD B2C (Local Account) method of signing in for additional security. In this method, properties must update the user records with email addresses that the users can log on to the application with later.

The following preferences can be customized if customers opt for a Local Account:

  • Email domain, if applicable

  • Is multifactor authentication required (Available options include Email, SMS and/or Phone call, Authenticator App)

  • Is reCAPTCHA required

  • Password complexity (Simple, Strong, Custom)

  • Web session timeout