Single sign-on

From MaxTrax 8.0, users can sign in with their organization's Microsoft Entra ID or Google Workspace account, or another OpenID Connect provider such as Okta. It is off unless the server's administrator sets it up. Signing in with a MaxTrax user name and password keeps working beside it, for contractors, NDE vendors and anyone outside your organization.

How users are matched

• No accounts are created. An administrator still adds each user in MaxTrax and gives them a role and projects. See Users and roles. Single sign-on only proves who someone is.
• Matched by email address. The sign-in uses the MaxTrax user whose Email is the same as the work account's address. For Entra ID that is the user principal name. Each email address belongs to one MaxTrax user only.
• Your organization's own users only. Guests in your Entra tenant and personal accounts are refused; they sign in with a MaxTrax password.
• Linked on first use. The first sign-in ties the MaxTrax user to that work account. After that, a different account with the same address is refused, so a reassigned mailbox cannot open the old owner's MaxTrax account. Changing the user's email in MaxTrax clears the link.
• Locks still apply. A user an administrator has locked or removed cannot sign in this way either.

If a sign-in is refused, the sign-in page shows a short message, and the reason is written to the site's Security- log.

Set up Microsoft Entra ID

In the Entra admin center, as someone who may register applications:

1. App registrations, New registration. Choose Accounts in this organizational directory only. Set the redirect URI to platform Web and https://your-maxtrax-address/service/auth/oidc (include the IIS virtual directory, if the site has one).
2. Note the Application (client) ID and the Directory (tenant) ID.
3. Under Certificates & secrets, add a client secret. Put its value straight into the server's settings or your key vault; do not email it. Note when it expires: single sign-on stops working then, and passwords carry on.
4. Under API permissions, choose Grant admin consent. MaxTrax asks only for openid, profile and email.
5. Optional: in Enterprise applications, set Assignment required to Yes and assign the users or groups who may use MaxTrax.

Then set these server settings and restart the site:

• MAXTRAX_OIDC_AUTHORITY: https://login.microsoftonline.com/your-tenant-id/v2.0. It must name your tenant.
• MAXTRAX_OIDC_CLIENT_ID: the application (client) ID.
• MAXTRAX_OIDC_CLIENT_SECRET: the client secret. On App Service, a Key Vault reference works.
• Optional: MAXTRAX_OIDC_ALLOWED_DOMAINS (email domains that may sign in, comma-separated), MAXTRAX_OIDC_BUTTON_LABEL (default Sign in with Microsoft) and MAXTRAX_OIDC_REDIRECT_URI (the redirect URI exactly as registered, when a proxy means the server sees a different address).

The web server needs outbound HTTPS to login.microsoftonline.com.

Add Google beside Microsoft

Each further provider has a name in its settings, such as MAXTRAX_OIDC_GOOGLE_AUTHORITY, and signs in at /service/auth/oidc-google. The sign-in page shows a button for each.

1. In the Google Cloud console, in a project your organization owns, set the OAuth consent screen's user type to Internal.
2. Create an OAuth client ID of type Web application, with the redirect URI https://your-maxtrax-address/service/auth/oidc-google.
3. Set MAXTRAX_OIDC_GOOGLE_AUTHORITY to https://accounts.google.com, plus MAXTRAX_OIDC_GOOGLE_CLIENT_ID, MAXTRAX_OIDC_GOOGLE_CLIENT_SECRET and MAXTRAX_OIDC_GOOGLE_ALLOWED_DOMAINS (your Workspace domains; required for Google).

The web server needs outbound HTTPS to accounts.google.com, oauth2.googleapis.com and www.googleapis.com. Other OpenID Connect providers are set up the same way, with their issuer address as the authority.

Check it works

The site's start-up log says "Single sign-on with ..." when it is on. If a setting is missing or wrong, single sign-on stays off and the log names the setting. Make sure each user's MaxTrax email is their work address before they try it.

Not included

Signing out of MaxTrax does not sign you out of Microsoft or Google. Users are not created automatically from the directory, and there is no switch to turn off a user's MaxTrax password.