Home
Authentication Identity Configuration
This section explains how Innovapptive’s mobile applications handle user authentication in a multi-tenant deployment environment. The authentication framework is based on federated Single Sign-On (SSO) and secure token-based session management.
Federated SSO Login Flow
Innovapptive’s mobile apps authenticate users using federated SSO, integrating with tenant-managed identity providers like Azure AD, Google, or Okta.

Title and Copyright
Copyright and Terms of Use page for iPermits Configuration.
Preface
Understand audience, know related documents and products and conventions followed in this document.
Introduction
The iPermits Configuration Guide is your blueprint for shaping how iPermits works in your organization.
Log in to Application
This Section guides users on how to securely access the platform using their credentials across web and mobile applications.
Navigate to the iPermits Configuration
This section helps you get familiar with the layout of the platform and how to access various modules efficiently.
Customer Tenant Onboarding with Azure IDP
This section provides step-by-step instructions to configure a customer’s Azure Active Directory (Azure AD) for federated Single Sign-On (SSO) with Innovapptive mobile applications. It applies to IT administrators and implementation engineers performing customer onboarding.
Authentication Identity Configuration
This section explains how Innovapptive’s mobile applications handle user authentication in a multi-tenant deployment environment. The authentication framework is based on federated Single Sign-On (SSO) and secure token-based session management.
- Federated SSO Login Flow
  Innovapptive’s mobile apps authenticate users using federated SSO, integrating with tenant-managed identity providers like Azure AD, Google, or Okta.
- Token-Based App API Flow
  After the user is authenticated via SSO, the mobile app uses access and refresh tokens issued by the Auth Server to interact securely with backend services. This section explains how these tokens are generated, validated, and refreshed across service calls.
- Use the Token After Login
- Refresh Token Handling
- Alternatives for Users Table Synchronization
  If the Users Table cannot always be reliably synchronized with the tenant’s SSO server, alternative mechanisms may be considered to maintain alignment between user records and identity provider data.
Manage Users & Roles
This section explains how administrators can onboard users, assign appropriate roles and permissions, and organize users into groups to control access and responsibilities across the platform
Maintain Master Data
This section explains how to set up and manage the core reference data required to configure iPermits, ensuring consistent behavior across permits, workflows, safety rules, and reports across plants and teams.
Configure iPermits Settings
The Core Settings in iPermits define how key features behave across your organization. These settings control fundamental aspects of daily use, such as mobile bottom navigation, dashboard availability, and AI-powered capabilities.
Integration Setup
This section explains how to integrate Work Order data or other source systems into iPermits to enable permit creation and ensure permits are aligned with operational work planning and execution.
Design and Manage Permit Template
This section explains how administrators can create and manage permit templates to standardize permit structure, validations, and compliance across plants.
Design and Manage JHA Template
This section explains how administrators can create and manage JHA templates to standardize JHA structure, validations, and compliance across plants.
Design and Publish Forms
This section explains how to create and manage configurable Forms that can be embedded into permits and JHAs to enforce safety and compliance before work begins.
Customize Platform Settings
Set Up Notifications
The Notification Engine gives administrators control over system-generated alerts, helping teams stay informed about workflow events without being overwhelmed. It’s integrated with the iPermit mobile app, enabling flexible communication across devices.

Federated SSO Login Flow

Innovapptive’s mobile apps authenticate users using federated SSO, integrating with tenant-managed identity providers like Azure AD, Google, or Okta.

The following flow explains the complete authentication sequence—from mobile app launch to user provisioning—highlighting how the app, backend services, SSO server, and user management databases interact at each step.

The mobile app fetches the SSO method and Client ID for the tenant from the Innovapptive DB.
Based on the SSO type, the app displays a single sign-in button, such as Sign in with Google or Sign in with Okta.
When the user taps the button, an in-app browser opens and redirects them to the SSO login or consent screen.
Upon successful authentication, the SSO server redirects the user to Innovapptive’s landing URL with a one-time authorization code.
The app sends this code—along with the tenant ID—to the Auth Backend.
The backend sends a grant request to the SSO server using:
- Authorization code
- Client ID
- Client Secret
The SSO server responds with an access token and a refresh token.
Using the access token, the Auth Backend fetches the user’s profile details from the SSO server.
The backend then:
- Stores the user details and SSO refresh token in the Users Table
- Creates a Mongo Realm user with a unique password
The backend returns the following credentials to the mobile app:
- Realm username and password
- Basic Auth JWT token (used for secure API and DB sync)
Figure 1. Federated SSO Login Flow – From Mobile App to SSO and Backend Sync

Figure 2. Authentication Module Flow V1 – Step-by-Step Message Exchange Across Components

Reference: https://excalidraw.com/#json=Uc84zojdzuFrFQB_0mr-5,UHk6cX3C_yJpW-dDgC4nPw