What is Single Sign-On (SSO) in Akeneo Product Cloud?

Single Sign-On (SSO) lets people sign in to Akeneo Products such as the PIM with their company account instead of a separate PIM password. 

You can set up SSO from Akeneo PIM, in System > Authentication, with a guided wizard. You never need to share certificates or secrets with Akeneo.

Akeneo Product Cloud supports SAML 2.0 or OpenID Connect, compatible with IdPs such as Microsoft Entra ID, Okta, Keycloak, etc.

How SSO works

When a person opens Akeneo PIM, they authenticate with their Identity Provider (IdP) through the Akeneo Product Cloud login page. After they sign in, they access the PIM with the Roles and User Groups assigned to them.

What SSO provides

• Centralized authentication: users sign in with their company credentials.
• Automatic Just-In-Time (JIT) provisioning (Premium feature): when a person signs in through the Identity Provider (IdP) for the first time, Akeneo PIM can create a PIM user from the information sent by the IdP to eliminate the need for account creation.
• Automated System for Cross-domain Identity Management (SCIM)-based lifecycle management (Premium feature): your Identity Provider (IdP) pushes user changes to Akeneo Product Cloud as they happen. Akeneo PIM creates, updates, or deactivates the PIM user accordingly, even before the user signs in for the first time, so access stays accurate at all times.
• Permission mapping available for JIT or SCIM: groups sent by the IdP can assign PIM Roles and User Groups.
• IdP-managed MFA: configure multi-factor authentication in your IdP.

Understand SSO behavior

• One SSO connection is shared by all of your PIM environments. Using a separate Identity Provider (IdP) for sandbox and production is not supported.
• People provisioned automatically through SSO do not have a PIM password. They sign in through the IdP.
• People who have a PIM password can use the password sign-in address when it is needed, for example, if they are not in your IdP or your IdP is unavailable.
• Signing out of the PIM does not sign the person out of their IdP or other Akeneo products.

Enable Single Sign-On (SSO) in Akeneo Product Cloud

Move from the PIM login to Akeneo Product Cloud login

There are two starting points. For both, we advise you to start with a sandbox if you have one: the connection is shared by your environments, so what you set up on the sandbox is reused on production.

From the PIM email/password login to the Akeneo Product Cloud login

Akeneo switches your environment to the Akeneo Product Cloud login. What your users see at their first sign-in after the switch:

1. The Akeneo Product Cloud login page. They sign in with their current PIM username and password. Nothing is reset.
2. If their username is not an email address, they are asked for their email, then must click the verification link sent to it.
3. If their name is missing, they are asked for it.
4. They land in the PIM.

Configure Single Sign-On (SSO) in the Identity-as-a-Service platform AUTH0 so that your users authenticate with your Identity Provider (IdP) when they access Akeneo PIM.

Enable Single Sign-On (SSO) in Akeneo Product Cloud

Set up SSO with your PIM administrator and IT or identity team. The PIM administrator needs the System >  Manage the Single Sign-On (SSO) user role permission. Your identity team configures the application and claims (user information) in the IdP. Choose SAML or OpenID Connect before creating the connection. You cannot change the protocol or IdP type later without deleting and recreating the connection. 

From legacy PIM SSO (SAML) to Akeneo Product Cloud SSO

Before the switch (no user impact):

1. As available on request, to Premium customers only, ask Akeneo teams to enable the Akeneo Product Cloud login and SSO setup on your environments.
2. Check emails: each PIM user's email must match their IdP email. Fix mismatches in the PIM first.
3. List the people who are not in your IdP (agencies, consultants). They will use the password sign-in address. Check that they know their PIM password or can reset it.
4. In Akeneo PIM, open the System menu > Authentication, in the Akeneo Product Cloud SSO tab, click Create connection and complete the wizard. The legacy PIM SSO application stays in place.
5. Complete the Mapping rules and turn Enable permission mapping rules on. The rules grant PIM Roles and User Groups from the user's IdP groups, and only take back what they granted: Roles and User Groups assigned in the PIM are never removed. Write rules for every population you want managed from the IdP, administrators included
6. Set Send users straight to your identity provider to Yes and Save. It stays inactive while PIM SSO is on.

The switch:

1. In Akeneo PIM, stay in the System menu > Authentication, and from the PIM SSO tab, set SSO enabled to off and save. The next sign-in goes through Akeneo Product Cloud and your IdP.
2. Sign in with an IdP account and check the Roles and User Groups in the Mapping activity.

Rollback: turn SSO enabled back on in the PIM SSO tab. Users go back to legacy PIM SSO at their next sign-in.

What changes for users: existing accounts are kept and matched by email at the first sign-in (no one is recreated); new people no longer need to be created in the PIM beforehand (the IdP sign-in creates them); anyone who knows their PIM password can still use the password sign-in address; the legacy PIM SSO configuration stays on the PIM SSO tab as a fallback.

Prepare your IdP information (claims)

The setup wizard shows the callback URL, entity ID, and signing certificate that your IdP needs. In return, provide the connection details requested for your selected IdP and protocol.

Your IdP must send the user attributes required by the connection. This includes the person’s email address and name. If you plan to manage permissions through IdP groups, configure the groups claim too.

Set up the connection

1. In Akeneo PIM, open the System menu > Authentication.
2. Start the connection setup wizard.
3. Select your IdP and protocol.
4. Use the URLs, identifiers, and certificate shown by the wizard to create the application in your IdP.
5. Enter the IdP details requested by the wizard and review the expected claims.
6. Finish the wizard.
7. Configure permission mapping rules and decide whether to enable automatic redirect.

Choose your protocol and IdP

Select the protocol and IdP template that match your identity setup before you create the connection. Akeneo Product Cloud supports SAML 2.0 and OpenID Connect.

• SAML: use this protocol when your IdP provides SAML application settings, such as a callback URL, entity ID, and signing certificate.
• OpenID Connect: use this protocol when your IdP provides OpenID Connect application settings, such as a client ID, client secret, and discovery endpoint.

You cannot change the protocol, IdP type, or discovery endpoint after you create the connection. If you select the wrong option, delete the connection and create a new one.

Test before redirecting users

Test the connection with an IdP account before you enable automatic redirect. Check that the sign-in finishes successfully and that the expected user profile and permissions are applied.

• Confirm that the email address and name received from the IdP are correct.
• If you use group-based permission mapping, check Mapping activity: each entry shows the IdP groups received at that sign-in and the Roles and User Groups applied.

Turn on automatic redirect only when these checks succeed. With automatic redirect enabled, signed-out users go directly to your IdP instead of seeing the Akeneo Product Cloud login page.

Manage the connection over time

You can reopen the wizard to update supported IdP settings. For OpenID Connect, you can update the client ID, client secret, and communication channel. You cannot change the protocol, IdP type, or discovery endpoint on an existing connection.

Your company has one shared connection across its PIM environments. When you set up SSO from another environment, it reuses this connection. Enabling or disabling the connection applies only to the environment where you perform the action.

• Disable: stops new IdP sign-ins for the current environment. Existing sessions continue until they expire, and automatic redirect is turned off.
• Enable: allows IdP sign-ins again for the current environment.
• Delete: permanently removes the connection. Users who rely only on the IdP cannot sign in after their session expires.