How to Set Up SAML Single Sign-On for Infor OS
how to set up SAML SSO with Azure AD or Okta for Infor OS
Also searched as
- Infor OS single sign on identity provider setup
- Infor Federation Services SAML configuration
- Infor OS SSO login loop fix
- Infor Ming.le SSO Azure AD Entra
Short answer
Infor OS can trust your corporate identity provider, such as Microsoft Entra ID or Okta, through SAML 2.0 federation. You exchange metadata between the two sides, map a stable identifier such as the email or user principal name to the Infor user, and then test with a pilot user before switching everyone over.
Applies to: Infor OS multi-tenant cloud with Infor Federation Services; on-premises deployments use Infor Federation Services or ADFS integration with similar concepts
Federate Infor OS with your identity provider
- 1Confirm who can perform the change. Federation is configured by Infor Cloud Operations or by a tenant administrator in Infor OS, depending on your contract, so raise a request if you cannot see the identity settings.
- 2In your identity provider, create a new SAML 2.0 enterprise application for Infor and capture its metadata URL or XML, including entity id, sign-on URL and signing certificate.
- 3Obtain the Infor service provider metadata for your tenant (entity id and assertion consumer service URL) and enter it in the identity provider application.
- 4Choose the NameID or claim that identifies the user, normally the email or user principal name, and make sure the same value exists on the Infor user record as the federation or sign-in identifier.
- 5Load the identity provider metadata on the Infor side, and set the mapping for the identifier attribute.
- 6Assign a small pilot group in the identity provider and test sign-in in a private browser window from the Infor OS URL, then from the identity provider launcher.
- 7Keep one break-glass local administrator, then move users in waves and watch the sign-in logs on both sides.
User matching is where most projects fail
SAML only proves who the identity provider says the person is. Infor still has to match that identity to an existing user, so the claim you send must equal the identifier stored in Infor, character for character. A mismatch of case, domain or alias typically produces an error page after a successful sign-in at the identity provider.
Check the legacy accounts before the switch. Many tenants hold users created years ago with personal email addresses or shortened names, while the corporate directory uses a different format. Reconcile these with a spreadsheet export first, then update the Infor side in bulk rather than discovering mismatches one login at a time.
Certificates and clocks
The signing certificate in the identity provider metadata expires, often after one to three years. When it rolls over and Infor still holds the old one, every sign-in fails with a signature validation message at the same moment. Put the expiry date in a calendar and replace the metadata before the date.
SAML assertions are valid for a short window. Clock skew on an on-premises identity server can reject assertions as not yet valid or already expired, so keep time synchronised with an NTP source.
Fixing login loops and downstream products
A loop between the Infor URL and the identity provider usually means the assertion is rejected silently, for example a wrong audience value, a missing NameID, or cookies blocked in an embedded frame. Capture the SAML response with a browser extension or the identity provider sign-in log and compare the audience and recipient values to the Infor metadata.
Remember that single sign-on to the portal does not by itself create access in each product. M3, SyteLine, LN and other applications still need their own user and role setup, often synchronised from Infor OS security roles. Test an actual application launch, not only the portal landing page.
Common pitfalls
- !Sending a claim value that does not match the identifier stored on the Infor user, which yields an unknown user error after a successful sign-in.
- !Letting the signing certificate expire. Track the date and rotate metadata ahead of it.
- !Cutting everyone over with no local break-glass administrator in case federation fails.
- !Testing only the portal home page and not application launch, where role problems appear.
- !Ignoring service accounts. API service accounts do not use SAML and should stay as ION API service accounts.
How an ERP-grounded AI assistant handles this
Identity is also what keeps AI honest. An assistant on top of Infor should inherit the signed-in user's roles, or run under a narrowly scoped service account, so SSO decisions flow through to what questions it can answer. ERPray respects ERP roles; with SAML in place, those roles map to real named people instead of shared logins, which makes its read-only query log meaningful.
Frequently asked questions
Does Infor OS support SAML 2.0?
Yes. Infor OS supports federation with SAML 2.0 identity providers such as Microsoft Entra ID, Okta and ADFS through Infor Federation Services. The details of who configures it depend on whether you are on the multi-tenant cloud or on premises.
Why do users reach Infor but get an unknown user error?
The identity provider authenticated them, but the claim sent to Infor does not match any Infor user identifier. Compare the NameID value to the user's federation identifier in Infor and fix case, domain or alias differences.
Will SSO change how API integrations authenticate?
No. ION API backend services keep using service accounts and OAuth tokens. SAML applies to people signing in interactively, not to scripts or middleware.
What happens when the identity provider certificate expires?
Sign-ins fail for everyone using that provider because the assertion signature cannot be validated against the old certificate. Load the renewed metadata on the Infor side before the old certificate expires.
Related
How to Create an .ionapi File and Service Account in Infor OS
An .ionapi file is a JSON credentials file you download from ION API after registering an Authorized App of type Backend Service and creating a service account for it. It carries the tenant, client id, client secret, the token and authorization endpoints, and the service account keys that your scripts or integrations use to request an OAuth 2.0 access token.
Error fixFix a Ming.le homepage widget that will not load
A blank or endlessly spinning Ming.le widget is usually a permissions, session, or backend availability problem, not a broken widget itself. Confirm the issue is widget-specific, check the user's Security Group access to the underlying app, and look at the widget's network calls in browser dev tools to see whether it is failing with 401/403 or simply timing out against a down service.
Error fixFix a 401 Unauthorized error from Infor ION API
A 401 from ION API almost always means the credentials in the .ionapi file no longer match what ION API Gateway expects - not that the password is simply wrong. Check whether the Authorized App or service account behind the file was revoked, regenerated, expired, or issued for a different tenant, then re-test with a direct OAuth2 client_credentials call before touching any calling code.
CIO briefingBuilding an ERP Modernization Roadmap That Includes AI
Sequence a modernization roadmap as data and integration cleanup first, a grounded AI query layer second (which can run on the current ERP, before any platform upgrade), and platform migration or upgrade third, timed on its own business case rather than forced early to enable AI. Trying to do all three simultaneously is the most common way modernization programs stall.
Error fixDiagnose and fix a failed BOD document flow in ION Desk
A Document Flow showing Failed in ION Desk means a BOD (Business Object Document) stopped either at schema validation, at the mapping step, or at the target application. Open the failed instance's detail to see the exact failing element, fix the source data or mapping, then use Resubmit rather than re-triggering the original transaction to avoid duplicates.
How-toHow to query Infor Data Lake with Compass SQL
Compass is the SQL query layer in Infor OS for querying Infor Data Lake, where flattened copies of BODs published over ION are stored by Noun and Verb. Open a Compass SQL Workbench tab, browse the schema for the correct table, and run a filtered SELECT rather than pulling the full history, since Data Lake tables can hold years of append-only data.
AI for ERPAI Agents Over Infor ION API, BODs, and the Infor Data Lake
Build AI agents on Infor ION API Gateway, BODs, and Data Lake, alongside or instead of Infor's own GenAI features, with your choice of model and hosting.
AI for ERPAI for Infor M3: A Practical Path from MI Programs to a Private Assistant
Add grounded AI to Infor M3: natural-language answers over MI programs and MEC, agents for distribution and manufacturing, on-prem or private cloud in Europe.
Stuck on Infor OS (Federation Services)?
Talk to engineers who work inside Infor OS (Federation Services) every week, and who build private AI that answers these questions from your own ERP data.