Quick Answer
Pinnacle Series supports Single Sign-On (SSO) using SAML or OpenID with an identity provider such as Microsoft Entra ID or Okta, and also supports Exchange Web Services and Pinnacle Series Password Authentication as alternative sign-in methods.
What This Article Helps With
This article explains the authentication methods available in Pinnacle Series and how to begin configuring Single Sign-On (SSO) for your organization. It is intended for Pinnacle Series Administrators and IT Administrators responsible for identity and access management. Use this article if you need to connect Pinnacle Series to Microsoft Entra ID or Okta, decide between SAML and OpenID, configure or review Pinnacle Series Password Authentication settings, configure Exchange Web Services authentication, or determine which users or groups should be permitted to use SSO.
Before You Begin
Before configuring SSO, ensure that you have:
- Administrative access to your organization's identity provider.
- Pinnacle Series administrator permissions.
- A stable network connection while completing the configuration.
- The appropriate permissions within Microsoft Entra ID, Okta, or your chosen identity provider.
For Microsoft Entra ID configurations, you need one of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or Owner of the service principal.
Supported Authentication Options
SAML
Configure federated Single Sign-On between Pinnacle Series and an identity provider such as Microsoft Entra ID or Okta. SAML is assertion-based and is a widely adopted standard for enterprise SSO.
OpenID
Configure OpenID-based authentication using the identity-provider URLs, Client ID, Signing Key URL, and related application settings required by Pinnacle Series. OpenID is token-based.
Password Authentication
Administrators can set requirements for users who sign in directly with a Pinnacle Series username and password, under Admin > Security & Authentication > Password Authentication. Available settings include Use Complex Passwords (minimum of eight characters, at least one uppercase and one lowercase character, and at least one special character), Password Expires in [X] Days, Password Cannot Match Previous [X] Password(s), and Remove 'Forgot Password' Availability for Users.
Exchange Web Services
Exchange Web Services authentication can be used with an on-premise Microsoft Exchange Server or Office 365. This option does not support multi-factor authentication (MFA); MFA must be disabled on the Exchange service for Exchange Web Services to work with Pinnacle Series SSO.
Configure Single Sign-On
- Review the prerequisites above and decide which authentication method you will use (SAML, OpenID, Exchange Web Services, or Password Authentication).
- Create or configure the Pinnacle Series application in your identity provider (for example, as an Enterprise Application in Microsoft Entra ID, or as an application integration in Okta).
- In Pinnacle Series, open Admin > Security & Authentication.
- Select the authentication method you are configuring and select Configure.
- Exchange the required URLs, identifiers, certificates, or application credentials between Pinnacle Series and your identity provider.
- Configure which users or groups are permitted to access Pinnacle Series through SSO.
- Select Save.
- Test the configuration by signing in with a test account. Confirm that authentication succeeds before rolling the configuration out to additional users.
Detailed Setup Instructions
For complete step-by-step configuration instructions, including screenshots and provider-specific examples, refer to the Security and Authentication – Pinnacle Series Single Sign-On and Password Settings Guide.
The guide includes:
- Microsoft Entra ID SSO benefits and prerequisites
- Password Authentication settings
- Microsoft Entra ID SAML configuration
- Microsoft Entra ID user assignment
- Okta SAML configuration
- OpenID configuration
- Okta OpenID configuration
- Exchange Web Services configuration
- Authentication testing and troubleshooting guidance
Important Considerations
When configuring SSO:
- Ensure the email address or user identifier returned by your identity provider matches the corresponding Pinnacle Series user account.
- Decide whether SSO access should be available to all eligible users or restricted to explicitly assigned users or groups.
- Test the configuration with a small number of users before wider deployment.
- Do not remove an existing working authentication method until the new SSO configuration has been successfully tested.
- Record the configuration values used in both Pinnacle Series and your identity provider for future troubleshooting.
Helpful Tips
- We recommend SAML or OpenID over Exchange Web Services for SSO configuration. Exchange Web Services is not a dedicated SSO protocol and may introduce security risks when used for authentication; Microsoft has also announced plans to retire Exchange Web Services.
- Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID in January 2024. References to Azure AD or AAD refer to the same service.
Common Questions
What should I check if authentication fails after I configure SSO?
Verify that all URLs, identifiers, certificates, Client IDs, and user attributes match between Pinnacle Series and your identity provider. If the values appear correct but authentication continues to fail, log a support ticket and include the authentication method being configured, your identity provider, the exact error message received, and any relevant screenshots.
Can I use Exchange Web Services with multi-factor authentication (MFA)?
No. Exchange Web Services does not support multi-factor authentication. MFA must be disabled on the Exchange service for Exchange Web Services to work with Pinnacle Series SSO.
Should I use SAML or OpenID for Single Sign-On?
Pinnacle Series supports both. SAML is assertion-based (XML) and has a longer track record in enterprise SSO; OpenID is token-based (JSON). If you already use SAML with other systems, continuing with SAML may be more straightforward; otherwise, either option is supported.
Which Microsoft Entra ID roles can configure SSO?
You need one of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or Owner of the service principal, in addition to Pinnacle Series administrator permissions.
Still Need Help