Single Sign-On (SSO) is typically configured during the initial installation of MOVEit Automation. However, it can also be set up or modified after installation or following an upgrade, providing flexibility for administrators to adjust authentication settings as needed. Changes to SSO configuration, including enabling or modifying settings, are restricted to users with administrative privileges. Once SSO is configured, administrators can adjust the configuration as needed.

Integration with third-party identity providers is required to configure SSO on MOVEit Automation. MOVEit Automation supports authentication via OpenID Connect (OIDC) and has been tested with the following Identity Providers:Other OIDC-compliant providers are not explicitly validated but are expected to be compatible with the MOVEit Automation authentication framework.

Configuring SSO with Microsoft Entra ID

Prerequisites

Ensure you have access to your organization's pre-configured Entra portal and the MOVEit Automation server. You must have administrative rights to complete the setup.

Required values and token configuration

Log on your organization's Entra portal. Collect the following details from the App Registration for MOVEit Automation within your Microsoft Entra portal:
  • Client ID: is a unique identifier assigned to your application when you register it with the identity provider, located in the app registration overview.
  • Tenant (Directory) ID: is a unique identifier assigned to your organization’s instance. It is used to identify your tenant across cloud services like Microsoft 365, Azure, and MOVEit when integrating with SSO. It is located in the app registration overview.
  • Issuer URL: is a unique identifier for the identity provider and is used by clients to validate tokens. For example, the format for a Microsoft Entra ID Issuer URL is:
    https://login.microsoftonline.com/tenant_id/v2.0
  • Redirect URI: The URI to which the identity provider will send authentication responses. This value must be registered in the Entra App Registration as a single‑page application (SPA) Redirect URI and must exactly match the Web Admin URL.

Token configuration

To ensure MOVEit Automation receives the required user identity information, update the token configuration as follows:
  1. In the App Registration, go to Token Configuration.
  2. Click Add optional claim.
    • Choose Token Type: ID.
    • Select the following claim:
      • onprem_sid
    • To save the changes, click Add.
Update the MOVEit Automation Configuration

The config.properties file is in the HOME\MOVEit\MOVEit Automation Web Admin\Tomcat\webapps\ROOT\WEB-INF\classes\ directory. Where HOME is the MOVEit Automation directory that is created during installation.

  1. Open the config.properties file in a text editor As Administrator.
  2. Edit the following properties:
    Table 1.

    Property

    Description

    Values

    security.auth.grant-enabled.token-exchange=

    Enables SSO, allowing MOVEit to exchange an external token for an internal session.

    True or False

    security.auth.grant-enabled.password=

    Enables password access, allowing traditional username/password log on.

    True or False

    security.auth.hide-ui-password-login=

    Controls whether the password login option is visible in the UI. If set to true, users will only see the SSO login option.

    True or False

    For more information about the logon options, see SSO log on options.

    security.auth.username-claim-name=

    Defines the claim that MOVEit should use as the username. This is how the user is identified in MOVEit.

    For example, preferred_username

    security.auth.sid-claim-name=

    Specifies the claim that contains the SID (Security Identifier), often used for mapping to on-prem AD. users

    For example, onprem_sid

    security.auth.oidcClientId=

    The Client ID registered in your identity provider. MOVEit uses this to identify itself during authentication.

    For example, 12345678-90ab-cdef-1234-567890abcdef

    security.auth.oidcIssuerURL=

    The Issuer URL of your identity provider. This tells MOVEit where to validate tokens.

    For example, https://login.microsoftonline.com/tenant_id/v2.0
  3. To save the config.properties file, close the file and restart MOVEit Automation Web Admin service in Services.

Configuring SSO with AD FS

Prerequisites

Ensure you have access to your organization's AD FS server and the MOVEit Automation server. You must have administrative rights to complete the setup.

Create an Application Group in AD FS

To add an application group to your AD FS server:
  1. Open the AD FS Management Console.
  2. Click Application Groups > Add Application Group:
    • Enter a name for the application group.
    • Select Web browser accessing a web application.
    • The Client identified field auto-populates the Client ID.
    • Add the Redirect URI. This is the MOVEit Automation Web Admin URL.
    • Choose access control policy settings based on you organization's requirements and complete the Wizard steps.

Update the MOVEit Automation Configuration

The config.properties file is in the HOME\MOVEit\MOVEit Automation Web Admin\Tomcat\webapps\ROOT\WEB-INF\classes\ directory. Where HOME is the MOVEit Automation directory that is created during installation.

  1. Open the config.properties file in a text editor As Administrator.
  2. Edit the following properties:

    Property

    Description

    Values

    security.auth.grant-enabled.token-exchange=

    Enables SSO, allowing MOVEit to exchange an external token for an internal session.

    True or False

    security.auth.grant-enabled.password=

    Enables password access, allowing traditional username/password log on.

    True or False

    security.auth.hide-ui-password-login=

    Controls whether the password login option is visible in the UI. If set to true, users will only see the SSO login option.

    True or False

    security.auth.username-claim-name=

    Defines the claim that MOVEit should use as the username. This is how the user is identified in MOVEit.

    Typically upn for AD FS

    security.auth.sid-claim-name=

    The claim for SID.

    Typically sid for AD FS

    security.auth.oidc-client-id=

    The Client ID from AD FS application group.

    For example, 12345678-90ab-cdef-1234-567890abcdef

    security.auth.oidc-issuer-url=

    The Issuer URL of your AD FS server.

    For example, https://your-adfs-server/adfs
  3. To save the config.properties file, close the file and restart MOVEit Automation Web Admin service in Services.