This article goes through all the steps to configure Google Single Sign, a fast and secure way to log into the CultureSuite CMS.
Client = manages the Microsoft Entra ID (Azure) environment CultureSuite = manages the Keycloak environment
Step 1: Request the Redirect URI from CultureSuite
- Contact our Customer Success team to request the Redirect URI.
Step 2: Register the Application in Microsoft Entra ID
The Client sets up the OAuth credentials using the URI received from CultureSuite (see screenshots of substeps at the bottom of this article).
- Go to the Azure Portal and navigate to Microsoft Entra ID.
- Go to App Registrations → New Registration.
- Fill in the following:
- Name: e.g. Keycloak-Integration
- Supported account types: Accounts in this organizational directory only
- Redirect URI: paste the URI received from CultureSuite in step 1
- Click Register.
- Navigate to Certificates & Secrets → New client secret, create a secret and copy the value immediately.
- Under API Permissions, select Add a permission, select Microsoft Graph.
- Add click Grant admin consent:
openidemailprofileUser.Read
- Copy the Application (Client) ID from the app's Overview page.
- From the Azure Portal overview, also copy the Tenant ID.
📤 Client sends to CultureSuite: the Client ID, the Client Secret, and the Tenant ID.
Step 3: CultureSuite configures the Entra ID Identity Provider in Keycloak
Step 4: Verify the Integration
- Open the CMS login page for the configured realm.
- Confirm that Login with Microsoft Entra ID appears as an option.
- The first time you log in, you are shown a message. This means your log in was succesfull, but you don’t have a CMS role yet (admin or user).
- If you are the first (admin), please contact CultureSuite so we can set your admin role.
- After that, you can configure roles for all your colleagues via the CMS users module after their first login.
Take note! The SSO button can replace the familiar username + password fields. So make sure all your CMS users have a Microsoft account to access the new SSO.
If you still want to be able to also log in the “classic” way via a password and email, we can keep that option available too.
For Entra we create new accounts in the CMS, that need to get an Admin or User role. You can do that yourself for your new account and for your colleagues if the classic login way is still active and you have admin access on the original account. After your Entra account is set-up, you can delete your old CMS account.
If classic access is disabled, CultereSuite needs to assign admin rights to the first SSO account, and after that, with this new account, you can assign user or admin rights yourself to all colleagues after their first SSO login attempt.
Information Exchange Summary
# | From | To | What |
1 | CultureSuite | Client | Keycloak Redirect URI |
2 | Client | CultureSuite | Tenant ID, Client ID & Client Secret |
Related articles