{"id":6836,"date":"2023-10-12T08:56:01","date_gmt":"2023-10-12T06:56:01","guid":{"rendered":"https:\/\/helpdesk.kontainer.com\/article\/establish-an-sso-connection\/"},"modified":"2026-03-17T09:14:20","modified_gmt":"2026-03-17T08:14:20","slug":"sso-single-sign-on-anbindung-einrichten","status":"publish","type":"article","link":"https:\/\/helpdesk.kontainer.com\/de\/article\/sso-single-sign-on-anbindung-einrichten\/","title":{"rendered":"SSO (Single-Sign-On) Anbindung einrichten"},"content":{"rendered":"<p class=\"p1\">You can set up users in Kontainer via SSO to create a secure and seamless experience for your internal users.<\/p>\n<p class=\"p1\">We have a standard setup for Microsoft Entra ID, ADFS and Google. <a href=\"mailto:js@kontainer.com?subject=SSO%20Enquiry\"><strong>Get in touch for other setups<\/strong><\/a>.<\/p>\n<p class=\"p1\">We create a \u2018\u2019Trust\u2019\u2019 between your Active Directory groups (managed by your IT) and Kontainer. This means the user will automatically be created and assigned to predetermined groups when they log in the first time.<\/p>\n<p class=\"p1\">Like any other group in Kontainer, you can always change and manage access settings.<\/p>\n<p class=\"p1\">You can also assign extra rights to individual users that are added to the basic permissions, they inherit from their group membership.<\/p>\n<p class=\"p1\">To keep your user list manageable, you can determine rules that will deactivate or delete users that have not been logged in for a certain amount of time \u2013 like 2, 4 or 6 months. If a user logs in again after being auto-deleted, their user is simply reactivated.<\/p>\n<p class=\"p1\">Alongside SSO users, you can add other users and groups manually.<\/p>\n<p>In the following, we will walk you through the setup of a Microsoft Entra ID SSO connection to Kontainer:<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p>&nbsp;<\/p>\n<h2 class=\"p2\">Azure\/Entra ID App Registration<\/h2>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3 class=\"p2\"><em>Step 1:<\/em> <strong>Create a resource<\/strong><\/h3>\n<p class=\"p2\">On Entra ID services home click \u201d<strong>Entra ID Active Directory<\/strong>\u201d<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5344\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-1.png\" alt=\"\" width=\"800\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3 class=\"p2\"><em>Step 2: <\/em><strong>Register app<\/strong><\/h3>\n<p class=\"p2\">In the right menu, click \u201d<strong>App registrations<\/strong>\u201d<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5365\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-2.png\" alt=\"\" width=\"300\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4 class=\"p2\"><strong>New Registration<\/strong><\/h4>\n<p class=\"p2\">At the top, click \u201c<strong>New registration<\/strong>\u201d<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5363\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-3.png\" alt=\"\" width=\"800\" \/><\/p>\n<p>&nbsp;<\/p>\n<h3><\/h3>\n<h4 class=\"p2\"><strong>Fill in the details<\/strong><\/h4>\n<ul>\n<li class=\"p2\"><strong>Name:<\/strong> Kontainer<\/li>\n<li class=\"p2\"><strong>Redirect URI:<\/strong> <a href=\"https:\/\/xxx.kontainer.com\/login\/entraid\">https:\/\/xxx.kontainer.com\/login\/entraid<\/a> <span class=\"s2\">(<\/span>replacing xxx with Kontainer client id)<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5361\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-4.png\" alt=\"\" width=\"800\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 3:<\/em> <strong>Authenticate<\/strong><\/h3>\n<p class=\"p1\">Click \u201c<strong>Authentication<\/strong>\u201d and fill in details:<\/p>\n<ul>\n<li class=\"p1\"><strong>Logout URL:<\/strong> <a href=\"https:\/\/xxx.kontainer.com\/logout\"><span class=\"s1\">https:\/\/xxx.kontainer.com\/logout <\/span><\/a><\/li>\n<\/ul>\n<p class=\"p1\">Check the boxes<\/p>\n<ul>\n<li class=\"p1\">\u201c<strong>ID tokens<\/strong>\u201d<\/li>\n<li class=\"p1\">\u201c<strong>Multitenant<\/strong>\u201d<\/li>\n<\/ul>\n<p>Click \u201c<strong>Save<\/strong>\u201d<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5359\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-5.png\" alt=\"\" width=\"800\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 4: <\/em><strong>Certificate and secret<\/strong><\/h3>\n<p class=\"p1\">Click \u201c<strong>Certificates and secrets<\/strong>\u201d and then\u00a0\u201c<strong>New client secret<\/strong>\u201d.<\/p>\n<p class=\"p1\">Fill in:<\/p>\n<ul>\n<li class=\"p1\"><strong>Description:<\/strong> Kontainer<\/li>\n<\/ul>\n<p class=\"p1\">Set &#8222;<strong>Expires<\/strong>&#8220; to \u201c<strong>Never<\/strong>\u201d<\/p>\n<p class=\"p1\"><strong>NOTE:<\/strong> Write down secret.<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5357\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-6.png\" alt=\"\" width=\"800\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 5:<\/em> <strong>Token configuration<\/strong><\/h3>\n<p class=\"p1\">Click \u201c<strong>Token configuration<\/strong>\u201d, and then \u201c<strong>Add optional claim<\/strong>\u201d.<\/p>\n<p class=\"p1\">Select \u201c<strong>ID<\/strong>\u201d and check<\/p>\n<ul>\n<li class=\"p1\">\u201c<strong>email<\/strong>\u201d<\/li>\n<li class=\"p1\">\u201c<strong>upn<\/strong>\u201d<\/li>\n<\/ul>\n<p class=\"p1\">Click \u201c<strong>Add<\/strong>\u201d.<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5355\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-7.png\" alt=\"\" width=\"800\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 6:<\/em> <strong>Edit group claim<\/strong><\/h3>\n<p style=\"font-weight: 400;\">Click &#8222;<strong>Add groups claim<\/strong>&#8220; and check:<\/p>\n<ul>\n<li style=\"font-weight: 400;\">&#8222;<strong>Security groups<\/strong>&#8222;<\/li>\n<li style=\"font-weight: 400;\">&#8222;<strong>ID<\/strong>&#8222;<\/li>\n<\/ul>\n<p>And then check:<\/p>\n<ul>\n<li>&#8222;<strong>Group ID<\/strong>&#8222;<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5353\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-8.png\" alt=\"\" width=\"400\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 7: <\/em><strong>API permissions<\/strong><\/h3>\n<p class=\"p1\">Go to &#8222;<strong>API permissions<\/strong>&#8220; and click &#8222;<strong>Add a permission<\/strong>&#8222;.<\/p>\n<p class=\"p1\">Choose &#8222;<strong>Microsoft Graph<\/strong>&#8220; and click \u201c<strong>Delegated permissions<\/strong>&#8222;<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5351\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-9.png\" alt=\"\" width=\"600\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h4><strong>OpenID permissions<\/strong><\/h4>\n<p>Scroll down to OpenID permissions and check <strong>\u201cemail\u201d<\/strong> and <strong>\u201cprofile\u201d<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/09\/Entra-ID-App-Registration1.jpeg\" \/><\/p>\n<h4><strong>Application permissions<\/strong><\/h4>\n<p>Scroll down to &#8222;Application&#8220; and check <strong>\u201cApplication.Read.All\u201d<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2026\/01\/Screenshot-2026-01-15-at-07.52.16.png\" width=\"686\" height=\"184\" \/><\/p>\n<h4><strong>GroupMember<\/strong><\/h4>\n<p class=\"p1\">Scroll down to \u201c<strong>GroupMember<\/strong>\u201d and check:<\/p>\n<ul>\n<li class=\"p1\">\u201c<strong>GroupMember.Read.All<\/strong>\u201d<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-5349\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/04\/Entra-ID_img-10.png\" alt=\"\" width=\"600\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 8: <\/em><strong>Check permissions<\/strong><\/h3>\n<p class=\"p1\">Permissions should now be as below.<\/p>\n<p class=\"p1\">Perhaps you will need an administrator to consent the permissions.<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/helpdesk.kontainer.com\/wp-content\/uploads\/2025\/09\/permissions-Entra-ID-App-Registration1.jpeg\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3><em>Step 9: <\/em><strong>Send details to Kontainer support<\/strong><\/h3>\n<p class=\"p1\">Go to \u201c<strong>Overview<\/strong>\u201d where you can find the details below to send to your Kontainer contact or <a href=\"mailto:support@kontainer.com\">support@kontainer.com<\/a>:<\/p>\n<ul>\n<li class=\"p1\">\u201c<strong>Application (client) ID<\/strong>\u201d<\/li>\n<li class=\"p1\">\u201c<strong>Directory (tenant) ID<\/strong>\u201d<\/li>\n<\/ul>\n<p><strong>NOTE:<\/strong> Send the saved secret in a safe way.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sie k\u00f6nnen Benutzer in Kontainer \u00fcber SSO einrichten, um eine sichere und nahtlose Erfahrung f\u00fcr Ihre internen Benutzer zu schaffen.<br \/>\nWir haben eine Standardkonfiguration f\u00fcr Microsoft Entra ID, ADFS und Google.<\/p>\n","protected":false},"author":13,"featured_media":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","article-category":[109,112,125],"article-tag":[117,119,120,123],"class_list":["post-6836","article","type-article","status-publish","format-standard","hentry","article-category-admin-einstellungen","article-category-integrationen-plugins","article-category-nutzer-gruppen-rechte","article-tag-dam","article-tag-pim","article-tag-nur-fur-admins","article-tag-premium-pakete"],"_links":{"self":[{"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/article\/6836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/article"}],"about":[{"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/types\/article"}],"author":[{"embeddable":true,"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/comments?post=6836"}],"version-history":[{"count":3,"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/article\/6836\/revisions"}],"predecessor-version":[{"id":7236,"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/article\/6836\/revisions\/7236"}],"wp:attachment":[{"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/media?parent=6836"}],"wp:term":[{"taxonomy":"article-category","embeddable":true,"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/article-category?post=6836"},{"taxonomy":"article-tag","embeddable":true,"href":"https:\/\/helpdesk.kontainer.com\/de\/wp-json\/wp\/v2\/article-tag?post=6836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}