Skip to main content
Note: SSO is available if enabled for your workspace. Contact your Account Manager if you need this feature activated.

​
Converlens SSO overview

Converlens uses OpenID Connect (OIDC) for Single Sign-On (SSO). To enable OpenID Connect SSO you’ll need three values from your provider:
  • Client ID
  • Client Secret
  • Discovery URL
Then navigate to Settings > SSO (app.converlens.com/YOUR_WORKSPACE/admin/settings/sso) to put these details into your workspace configuration.
Remember to replace YOUR_WORKSPACE with your workspace URL key.

​
Instructions for obtaining SSO values

See below for instructions on how to obtain these values.

​
Microsoft Entra ID (previously Azure Active Directory (AAD))

Configuring Entra ID
  1. Find and open ‘Microsoft Entra ID’
  2. Click the ‘+ Add’ and select ‘App Registration’ to create a new app registration
  3. Name it “Converlens” or similar
  4. In ‘Supported account types’ choose: “Accounts in this organizational directory only”
  5. Under ‘Redirect URL’ select ‘Web’ and use: https://app.converlens.com/auth/callback
  6. Click ‘Register’
  7. Copy the ‘Application (client) ID’ and ‘Directory (tenant) ID’ to use in Converlens settings
  8. Now setup your Client secret: in your new app, under ‘Manage’ select ‘Certificates & secrets’
  9. In ‘Client secrets’ click to create a ‘New client secret’
  10. Choose a name (e.g. “Converlens Client Secret”) and a date for when this certificate should expire. Important: Your SSO integration with Converlens relies on a valid secret, so remember to create a new secret and repeat these steps before the old one expires.
  11. Copy the ‘Secret Value’ to use in Converlens settings
Configure Converlens with Entra ID values You can now use the settings you’ve copied above to configure SSO in Converlens.
  • Client ID: use the ‘Application (client) ID’ from step 7
  • Client secret: use the ‘Secret value’ from step 11
  • Discovery URL: use https://login.microsoftonline.com/TENANT/v2.0/.well-known/openid-configuration and change the TENANT text to be the ‘Directory (tenant) ID’ from step 8

​
Active Directory Federation Service (AD FS)

Configure ADFS Note: OIDC is supported only in AD FS version 2016 and later.
  1. Open the AD FS Management pane
  2. Select Application Groups and then select Add Application Group
  3. Select ‘Server Application’ and enter a name (“Converlens”) and optional description. Click Next.
  4. Copy the ‘Client Identifier’ value. This is the ‘Client ID’ used in Converlens settings.
  5. Enter the redirect URI https://app.converlens.com/auth/callback
  6. Next, in Configure Application Credentials select ‘Generate a shared secret’ and save this value as the ‘Client Secret’ in Converlens settings. Click Next twice and close.
  7. Double-click your new Application Group and click ‘Add application’. Under Standalone application choose Web API template and click Next.
  8. In Identifier add the Client Identifier from step 4 and also add the URI https://app.converlens.com. Click Next.
  9. Confirm that the Access Control Policy has permissions set to ‘Permit everyone’. Click Next.
  10. Application Permissions permitted scopes should include openid, profile, email and allatclaims. Click Next twice and close.
  11. Double-click the new Web API Application and click on the Issuance Transform Rules tab. Click Add Rule.
  12. For Claim rule template, choose Send LDAP Attributes as Claims. Click Next.
  13. For Claims rule name: Email claims. Attribute store choose: Active Directory. LDAP Attribute choose: E-Mail-Addresses. Outgoing Claim Type: email. Click Finish.
  14. Add another rule, and for Claim rule template choose: Send Claims Using a Custom Rule. Click Next.
  15. For Claim rule name: Skip userinfo. Custom rule => issue(Type = “skip_userinfo”, Value = “true”);
  16. Click Finish and restart the AD FS service to ensure all new settings are applied.
Configure Converlens with ADFS values You can now use the settings you’ve copied above to configure SSO in Converlens.
  • Client ID: use the ‘Client Identifier’ from step 4
  • Client secret: use the ‘Client secret’ from step 6
  • Discovery URL: use https://[Your ADFS hostname]/adfs/.well-known/openid-configuration replacing [Your ADFS hostname] with your ADFS server. For example if your ADFS server is running on adfs.example.net then your Discovery URL will be https://adfs.example.net/adfs/.well-known/openid-configuration

​
Other SSO providers

There are many other SSO providers that support OIDC. The general process for obtaining the values you need to enable SSO in Converlens is as follows:
  • Log in as an admin to your SSO provider’s administration dashboard
  • Create or add a “new application” (or similar). This will usually provide you with a ‘Client ID’ or identifier. Make a note of this.
  • You’ll need to configure a “redirect URL” (or similar) for the application. For this use: https://app.converlens.com/auth/callback
  • You’ll also need the ‘Client Secret’, sometimes called a ‘shared secret’. Some SSO providers will automatically create this when you create a new application, whereas others require you to create a standalone secret. Make a note of this value once available.
  • Finally you will need the “Discovery URL” which is the URL that Converlens uses to talk to your SSO provider.

​
Configure your Converlens settings

Once you have the Client ID, Client secret and your Discovery URL, you can update your Converlens organisation settings:
  1. Navigate to Settings > SSO (app.converlens.com/YOUR_WORKSPACE/admin/settings/sso)
    1. Remember to replace YOUR_WORKSPACE with your workspace URL key
  2. Activate Single Sign-on
  3. Complete the ‘Client ID’, ‘Client secret’ and ‘Discovery URL’ fields
  4. Save your changes
  5. Complete a successful SSO login before enabling Require SSO login for the workspace
If Require SSO login is enabled, all members must log in with SSO. If it is off, members may log in with either SSO or standard email login.