CareApp supports integrating with Open ID Connect compatible sign-on providers, such as Microsoft Entra ID, Okta, Auth0, KeyCloak, etc. When enabled, users signing in with a work email address will be directed to your SSO provider to sign in. 

By integrating your SSO provider with CareApp, you can meet your requirements for account centralisation, policies for passwords and FMA, etc.

Other members of your CareApp community, such as family members, continue to sign in with an email address and password, with authentication managed by CareApp.

Limitations

SSO integration replaces CareApp's inbuilt system for user authentication. However, the following limitations are in place:

• Only OIDC compatible authentication providers can be used
• CareApp is used to manage roles and permissions inside CareApp. We do not import permissions from the SSO provider

How It Works

CareApp's SSO integration works at the domain name level. We configure CareApp so that any user trying to sign in with an email address on your domain name needs to use the configured SSO provider.

Signing In

Users visit https://app.careapp.com.au like normal, and see the sign in screen. They type in their email address. Once entered, CareApp will hide the password entry field, replacing it with a button to sign in with SSO:

When the user presses the Sign In button, they will be redirected to your SSO provider to complete their login. Once complete, they will be redirected to CareApp

Accepting Invitations

New users continue to be invited to CareApp like before. However, if an invitation is sent to an SSO configured email domain, then the user must setup their account using SSO, as shown below:

Users will not be able to change their email address when accepting an invitation, and users will not be able to accept an invite unless they are the intended recipient:

Account Settings

CareApp users who sign in with SSO are unable to change their email address or password in CareApp. Instead, this is managed by the SSO provider:

Account Linking

Existing CareApp customers can change to using SSO at any time. Existing users will need to sign in with SSO when they next visit CareApp. CareApp will detect that the user is an existing user. They will be asked to enter their CareApp password to link the SSO profile with their existing profile.

Once this has been completed, the user will no longer be able to sign in with a CareApp password. Instead, they will be required to use SSO. By linking their accounts, their existing permissions and usage history is carried over into their new SSO managed account.

Technical Requirements and Setup

CareApp configures SSO on your behalf. To get started, you will need to:

1. Create an OIDC client in your SSO provider.
   1. Required scopes: email, openid, phone, profile
   2. OAuth Grant Types: authorization code
   3. Callback URLs: we will provide callback URLs for our production and testing environments
2. Provide the following to our team for setup:
   1. The SSO provider you are using (eg Okta, Google, MS Entra ID)
   2. Client ID
   3. Client Secret
   4. Issuer URL
   5. Where we source the claims, either from the token, or from the user info endpoint
   6. Depending on the SSO system in use, we may request additional information

Once you have configured an OIDC Client for CareApp and provided us with this information, we will enable SSO on your domain. We recommend setup on our testing infrastructure to verify functionality before moving to production.