Admin Portal
A narrow surface where your customer's IT admin sets up SSO for one account. It is separate from your dashboard.
The Admin Portal lets one IT admin at your customer set up SAML and turn on SCIM for one account. The IT admin needs no RealmSSO account, no password and no access to your dashboard. The portal does less than its name suggests. This page lists what it does and what it does not do.
What the IT admin gets
- A single-use invite link. The link lasts 30 minutes. The whole portal session ends 30 minutes after you made the link. One session covers one account. See Invite links.
- SAML setup. The IT admin gives a metadata URL, or the manual values. The manual values are the identity provider's entity ID, SSO URL and signing certificate. Saving again updates the same connection.
- The values for the identity provider. After the first save, the portal shows the ACS URL, the entity ID and the audience. The IT admin enters them in the identity provider.
- SCIM. The IT admin turns SCIM on and sets its token. The token has at least 32 characters. RealmSSO stores only its SHA-256 hash.
- Status. The portal shows each connection's status and its last recorded health.
What the portal does not have
| Not in the portal | Where it is |
|---|---|
| Metadata upload | The screen takes a metadata URL or the manual values. The portal API accepts pasted metadata XML, but no screen offers it. |
| A connection test | Your dashboard and the API can run a connection check. The portal has no test route. |
| A working OIDC tab | See the note below. You set up OIDC in the dashboard or the API. |
| A domain check | You prove an email domain with a DNS record, in your dashboard or the API. |
| An on/off switch | You set a connection to active or inactive in your dashboard or the API. |
| An event view | Your dashboard shows sign-in and SCIM counts and the 50 latest events. |
| A way to extend the session | The server fixes the session at 30 minutes from the invite link. The IT admin cannot change it. |
OIDC is not set up in the portal
You set up OIDC in the dashboard or the API. The portal's OIDC tab does not save today. It sends its save to a route that needs a dashboard session or an API key. The portal session has neither, so the save fails. The portal API has its own OIDC routes, but the tab does not use them.
The redirect URI that the OIDC tab shows is also wrong. Do not register it in the identity provider.
How the IT admin gets in
There is no sign-up. You invite an IT admin from the Accounts page in your dashboard, or with this call:
/api/v1/admin-portal/generate-linkThe call needs a dashboard session with at least the member role on the account. RealmSSO makes the invite link and tries to email it to the IT admin. The response holds the link as portalUrl, and says in emailSent whether the email went out. If it did not, give the link to the IT admin another way. The Invite links page describes each step.
The portal's tabs
The portal lives at /portal. It shows the account's name, its logo or a coloured initial, and five tabs.
| Tab | Route | What it does |
|---|---|---|
| Overview | /portal/dashboard | Lists the account’s connections with their status and last recorded health. |
| SAML Configuration | /portal/saml | Creates or updates the SAML connection from a metadata URL or the manual values. Shows the ACS URL, the entity ID and the audience after the first save. |
| OIDC Configuration | /portal/oidc | Does not save today. See the note above. |
| SCIM Directory Sync | /portal/scim | Turns SCIM on and sets its token. That is all the portal does for SCIM. |
| Settings | /portal/settings | Shows account details, the ACS URL, the entity ID and the SCIM URL with copy buttons, and when the session ends. |
The SCIM tab has no switch for deprovisioning, group sync or attribute mapping. The portal API sets those, and no screen does. See the SCIM API. The portal builds the SCIM URL that it shows from its own address. We have not measured that this address accepts SCIM calls.
The portal sends the invite link's token in the X-Admin-Token header on the first request. RealmSSO then issues a continuation token, and the portal uses that for later requests. The continuation token never outlives the 30 minutes from when you made the link. For the account and realm model behind these connections, see Accounts and isolation.
Branding
The portal shows a logo and an accent colour for the account. That is all the branding there is.
| Field | Type | Accepted as |
|---|---|---|
| logo | string or null | A URL. |
| brandColor | string or null | A 6-digit hex colour, for example #4f46e5. |
You set both fields through the accounts API. See the Accounts API.
/api/v1/accounts/api/v1/accounts/:idBoth routes accept optional logo and brandColor fields next to the name and the email domain. PATCH also accepts null to clear a field.
API only
No screen sets branding. Neither your dashboard nor the portal has a form for it. The IT admin cannot change the branding of the account. Branding is not a gated feature: every account has the two fields.
GET /api/v1/admin-portal/session returns account.logo and account.brandColor with the account's name and slug. The portal then uses them:
- If
logois set, the header shows it as an image. - Otherwise the header shows a coloured square with the first letter of the account name. The square uses
brandColor, or#4f46e5if the account has none. - The Settings tab also shows the colour as a swatch.
The portal has no custom CSS, no custom font and no favicon. It does not change its own wording for an account.