Configure Custom SSO for Procore
Note
If your organization is using the Portfolio Financials and Capital Planning products in Procore, you will need to reach out to your Procore point of contact or the Support team to set up SSO.
Background
Term | SP-Initiated Context | IdP-Initiated Context |
|---|---|---|
Identity Provider (IdP) | Authenticates the user after receiving a request from Procore. | Authenticates the user directly within the IdP portal and initiates the session. |
Service Provider (SP) | Procore—initiates the login request and consumes the returned assertion. | Procore—receives and validates the unsolicited assertion from the IdP. |
Issuer URL (Entity ID) | Identifies Procore as the entity requesting authentication. | Identifies your IdP as the entity issuing the authentication assertion. |
Target URL | The IdP endpoint where Procore sends the SAML AuthnRequest. | The IdP app tile/launch URL that routes the user directly to Procore. |
SAML | Protocol used to pass requests to the IdP and assertions back to Procore. | Protocol used to push pre-generated authentication assertions directly to Procore. |
X.509 Certificate | Verifies signatures on both outgoing requests and incoming assertions. | Verifies the IdP's digital signature on the incoming authentication assertion. |
The following configurations are supported with SSO:
Service Provider Initiated (SP-initiated) SSO. Referred to as Procore-initiated SSO, this option gives your end users the ability to sign in from the Procore Login page, and then redirects users to the login page for your IdP. Once the IdP authenticates the user's identity, the user is redirected back to and logged into Procore.
Identity Provider Initiated (IdP-initiated) SSO. With this option, your end users can first log into your IdP and select a Procore application tile to log into and open the Procore web application. If IdP-initiated SSO is configured, end users may also log into Procore directly using a conventional username and password.
Things to Consider
Required User Permissions:
To add Procore as a custom SAML application in your IdP tenant: Access to an administrator account.
To configure SSO in Procore: 'Admin' level permissions on the Company level Admin tool.
Steps
Add Procore as a Custom SAML Application in your IdP Tenant
Add Procore as a Custom SAML Application in your IdP Tenant
See your IdP's documentation for more information on the steps below.
Open a blank document on your computer.
Copy the SSO URL from your IdP and paste it into your blank document.
Copy the Entity ID from your IdP and paste it into your blank document.
Download the X.509 Certificate from your IdP.
Open the X.509 Certificate and copy the text between Begin Certificate and End Certificate.
Note: Depending on your IdP, the certificate generated may have a different marker to indicate the beginning and end of the certificate data. In any case, do not copy the markers. Only copy the certificate data between them.
Paste the X.509 Certificate text into your blank document.
Complete the following in your IdP:
Entity ID: https://login.procore.com/
Tip: When to use 'Enable Unique Entity ID' in ProcoreSingle Instance: If your company only manages one (1) Procore company instance, clear the Enable Unique Entity ID check box.
Multiple Instances: If your company manages multiple Procore company instances and requires a dedicated enterprise application for each instance in your IdP, mark the Enable Unique Entity ID check box. Note that each Procore instance is still limited to one (1) enterprise application.
Important Requirements & Limitations:
Email Domain Rule: Procore targets SSO users by email domain. An email domain can only be mapped to one (1) Procore company instance across the entire platform.
Generating the URL: You must select the Enable Unique Entity ID check box on the SSO Configuration page in the Company Admin tool before the unique Single Sign On Entity ID URL will appear in Procore (the service provider). Once generated, copy and paste this URL into the IdP's Entity ID field.
Access & Provisioning: Enabling this check box does not alter company access. Access to a company instance in Procore is determined by a user's presence in the company's Directory tool and their configured tool permissions. Automated user provisioning is not currently supported.
Start URL: Leave this field blank.
Certificate: Copy and paste the Certificate text from your blank document.
Signed Response: Mark this checkbox.
Name ID: Select Basic Information in the first drop-down menu and Primary Email in the second drop-down menu.
Name ID Format: Select EMAIL in the drop-down menu.
Configure SSO in Procore
Navigate to the Company level Admin tool in Procore.
Under Company Settings, click Single Sign On Configuration.
Complete the following:
Enter the Entity ID from your IdP in the Single Sign-On Issuer URL field.
Enter the SSO URL from your IdP in the Single Sign-On Target URL field.
Enter the Certificate text in the Single Sign-On X.509 Certificate field.
Click Save Changes.
Reach out to Procore Support or your company's Procore point of contact to request to configure the email domain you'd like to target for login via SSO.
After you receive confirmation that the appropriate domain(s) have been entered and your SSO configuration is ready, mark the Enable Single Sign On checkbox on the 'Single Sign On Configuration' page.
Do one of the following:
Select the Allow Password Login option (e.g., IdP-initiated flow).
Select the Service Provider Forward option (e.g., SP-initiated flow).
Click Save Changes.
Note: Upon saving your final configuration, SSO will become active for your end users. Enabling SSO will not interrupt any user sessions or force logout. The next time a user logs in to Procore, they will sign in using the selected method (IdP-intiiated or SP-initiated).