Setting Up Single Sign-On (SSO) for Your Customer Portal with Halo PSA

This guide will help you configure SSO for your customer portal using Halo PSA. Follow these steps carefully, referring to the screenshots provided.

Step 1: Navigate to the SSO Settings

1. Log in to your Benji Pays Portal admin account.
2. Go to Settings > Customer Portal Settings > SSO (Single Sign-On).
3. Select Halo PSA as the SSO provider.

Step 2: Configure the SSO Settings in Benji Pays Portal

1. Description: Enter a descriptive name for the SSO configuration (e.g., Halo PSA).
2. Issuer URL:
   • Navigate to Halo PSA: Configuration > Integrations > Halo PSA API > Authorization Server.
   • Copy the Authorization Server URL and paste it into the Issuer URL field in Benji Pays Portal.
3. Client ID:
   • In Halo PSA, go to Configuration > Integrations > Halo PSA API > View Applications.
   • Open the application you created for SSO and copy the Client ID.
   • Paste it into the Client ID field in the SSO settings.
4. Scope: Ensure the scope is set to

   openid profile email
   

5. Tenant (Optional):
   • If you need to specify a tenant, retrieve it from Halo PSA under Halo PSA API > Tenant.
   • Paste the Tenant name into the Tenant field.

Step 3: Configure Redirect URLs in Halo PSA

1. In the application configuration screen, Add the following URLs:
   • Login Redirect URL:

     https://yourbenjipaysportal.benjipays.com/callback?iss=xxxxxx-halopsa-xxxxxx
     

     (This can be copied from the Benji Pays SSO configuration screen.)
   • Logout Redirect URL:

     
     https://yourhalo-customer-portal-url.com/portal/
     

     (Ensure this is added in the logout settings of your Halo PSA integration.)

Step 4: Finalize and Enable SSO

1. In Benji Pays Portal:
   • Toggle the Show this Single Sign-On button on login page option if you want the SSO button to appear on the login page.
   • Enable the SSO configuration by toggling the Enabled option.
2. Save the configuration.

Step 5: Verify the SSO Setup

1. Open an incognito browser window.
2. Use the login URL provided in the SSO settings to test the configuration.
3. Log in using the SSO method:
   • The first-time login requires the user to verify their email address.
   • Users will receive a verification email with a link to confirm their ownership.
4. After verification, users will be redirected to the customer portal.

Step 6: Optional - Hide Standard Login

1. If you wish to disable the standard login:
   • Go to Settings > Customer Portal Settings in Benji Pays Portal.
   • Toggle the option to Disable Non-SSO Login methods

Step 7: Add a Login Button in Halo PSA Customer Portal

You can add a custom button in Halo that will take you to the Benji Pays portal via the SSO login so that the user is not prompted to login again.

1. In Halo PSA, go to Configuration > Portal Settings.
2. Scroll to the section for adding custom links:
   • Add a new link with the following details:
     • URL: Use the SSO login URL from Benji Pays Portal.
     • Title: Provide a meaningful label (e.g., Login to Benji Pays Portal).
     • Select where the button should appear (e.g., on the home screen or navigation bar).
3. Save your changes.

Step 8: Give your users access to their invocies

Benji Pays will use the email address associated with the Halo account used to log in to look up any customers in Benji Pays where that email has Portal Access enabled.  

You may have nothing to do here if your customers Halo accounts use the same email that you have in your customer records for them.

To add, remove or update emails on a customer - add their email to Halo so that it flows to QuickBooks and then to Benji Pays, add it to QuickBooks on the customers you want them to have access to or add them in Benji pays directly.  See this article for more info.

Notes and Considerations

• Ensure all URLs match the configuration in both systems to avoid login errors.
• Use separate incognito windows for testing portal login and admin settings to avoid session conflicts.
• For any issues, double-check the Issuer URL, Client ID, and Redirect URLs.