How do I set up and use SSO with Microsoft or Google?

SSO (Single Sign-On) lets you sign in to Tempolia with your Microsoft or Google account. Your company must first configure the chosen provider in Tempolia.

Prepare the accounts and OAuth application

Each user must already have a record in « Collaborators > Collaborators ». Their email address must match the one returned by Microsoft or Google and identify exactly one active collaborator: a past departure date or an address shared by several records prevents sign-in. SSO does not create collaborators and keeps the permissions set in « Collaborators > Collaborator login and permissions ».

Ask your IT administrator to create a Web OAuth application in Microsoft Entra ID or Google Cloud and register this exact redirect URI: https://cloud.tempolia.fr/en/modules/temps/action.php?mode=sso_oauth. For Microsoft, allow the delegated Microsoft Graph permission User.Read. For Google, configure consent with the openid email scopes.

Provider documentation: Microsoft Entra ID / Microsoft Graph and Google OpenID Connect.

Enter the SSO settings in Tempolia

Using the Administrateur account, open « Configuration > General options », edit the settings and open the SSO tab.

  • SSO server: login.microsoftonline.com for Microsoft or accounts.google.com for Google, without https:// or a path.
  • SSO client and SSO client secret: enter the OAuth client ID and secret value supplied by the application.
  • SSO tenant ID: enter the Microsoft Entra Tenant ID; this field can remain empty for Google.
  • SSO OAuth2 scope: User.Read for Microsoft or openid email for Google.
  • SSO button title: choose a non-empty label, such as “Sign in with Microsoft” or “Sign in with Google”.
  • Enable SSO: enable this option, then save.

Reopen the options to check the status shown in the SSO tab, then test a sign-in. This status checks that the settings are present; only a sign-in can validate the credentials and provider permissions.

Sign in with your Microsoft or Google account

On the sign-in page, enter your Tempolia client code, wait for the collaborators to load, then click the SSO button. Choose the account matching your Tempolia email address and follow the provider steps. You can always sign in with your Tempolia password, even when SSO is enabled. SSO is optional. If Tempolia requests a second factor, complete that check too; see the two-factor authentication FAQ.

What should I check if sign-in fails?

  • Missing button: check the client code, activation, button title and required settings, including the tenant for Microsoft.
  • Collaborator missing or ambiguous: check the email address, departure date and duplicate records. Microsoft returns its mail address or, if absent, its sign-in name (UPN); Google must return a verified email address.
  • Provider error: check the redirect URI, client ID, secret value and validity, scopes and application permissions. If the request has expired, start again from the sign-in page.

Related questions :