Skip to main content

Single Sign-On (SSO)

Steps for IT admins to enable SSO for uman via Google Workspace or Microsoft Entra ID, including app approval and access setup.

Updated over 2 weeks ago

uman uses OAuth 2.0 Authorization Code Grant flow for SSO authentication with the following specifications:

  • Client Type: Server-side application (confidential client)

  • Grant Type: Authorization Code Grant without PKCE

  • Client Authentication: Client Secret (stored securely server-side)

  • Token Types: Access tokens and ID tokens (where applicable)

Google Workspace

Technical Details

Client ID: 387164199820-8dv4g72djg0js6tu1qo2vqguisotvsg5.apps.googleusercontent.com

Redirect URIs: https://app.uman.ai/oauth2/callback/google

Required OAuth Scopes:

  • openid - For OpenID Connect authentication

  • email - To access user's email address

  • profile - To access basic profile information

  • https://www.googleapis.com/auth/userinfo.email - To read other related email addresses via People API

Expected User Attributes:

  • email (required)

  • email_verified (must be true)

  • sub (Google's unique user identifier)

  • given_name (optional)

  • family_name (optional)

Token Endpoint: https://oauth2.googleapis.com/token

Admin Steps to Whitelist uman Applications

Some Google Workspace domains restrict users from signing in to third-party applications (like uman) using their Google accounts. When attempting to sign in, the user may see a message such as: "Admin approval is required."

  1. Sign in to the Google Admin Console

  2. Navigate to App Access Control

    • From the Admin Console, go to Security > Access and Data Control > API Controls

    • Click on Manage App Access

  3. Add uman Application

    • Click "Configure New App"

    • Paste the Client ID into the search field and click Search

  4. Select the App and Assign Access

    • Click the one and only result

    • Define the scope, choose who should have access:

      • Everyone in your organization, or

      • Specific organizational units (OUs) if access needs to be scoped

  5. Trust the App

    • On the next screen, choose "Trusted"

    • Click Continue → then Finish

Microsoft Entra ID

Technical Details

Application ID: 8a9c2818-421e-433e-a19b-c455be7a0657

Redirect URIs: https://app.uman.ai/oauth2/callback/microsoft

Required OAuth Scopes:

  • openid - For OpenID Connect authentication

  • User.Read - To read basic user profile information

Expected User Attributes:

  • email or upn (at least one required)

  • tid (Tenant ID - Azure AD tenant)

  • oid (Object ID - user's unique ID in Azure AD)

  • given_name (optional)

  • family_name (optional)

Token Endpoint: https://login.microsoftonline.com/organizations/oauth2/v2.0/token

Admin Steps to Approve uman in Microsoft Entra ID

In some Microsoft environments, users may encounter an admin consent prompt when trying to log into uman with their Microsoft account. The user may see a message such as: "Need admin approval: This app requires your admin’s approval to sign in."

  1. Log in to the Azure Portal
    Visit: https://portal.azure.com

  2. Go to Microsoft Entra ID

    • Navigate to Microsoft Entra ID → then select Enterprise Applications

  3. Handle Admin Consent Requests

    • In the left-hand menu, click "Admin consent requests"

    • Locate the request related to uman

    • Review the permissions being requested

  4. Approve the Application

    • Click Approve to grant access to the app

    • Optionally, configure access policies or user/group restrictions if desired

Need additional technical support? Contact the uman implementation team with any questions about OAuth configuration or integration requirements.

Did this answer your question?