SuccessPro Single-Sign-On Getting Started (External)
What it is
SSO lets your advisors and home office users access SuccessPro without a separate login — they authenticate once through your existing identity system and land directly in the platform. SuccessPro uses the industry-standard SAML 2.0 protocol, so it's compatible with any modern identity provider you already use.
Compatible identity providers include:
- Microsoft Azure Active Directory
- Okta
- Oracle Identity Management
- OneLogin
- Any other SAML 2.0-compliant identity provider
What you get
Two login modes Users can initiate SSO from your internal portal (IdP-initiated) or from the SuccessPro login page (SP-initiated) — or both, depending on your workflow.
SSO-only access Optionally disable the standard username/password login so users can only access SuccessPro via your identity provider.
Deep-link landing After authentication, users can be sent directly to a specific resource in SuccessPro — not just the home screen — using configurable Relay States.
What we need from your tech team
The integration requires just four things from your side:
Unique user identifier (TSID)
Each user in your identity system needs a stable unique ID that matches what's stored in SuccessPro. This is the key that links the two systems.
System URLs
The SSO service endpoints for your identity provider, for both DEV and PROD environments.
Public certificates
Your IdP's public certificates that let SuccessPro verify your system's identity. We'll share ours in return.
Attribute Mapping
List of optional SAML claims (e.g.,
email, givenname, surname) and their expected formats if you want to pass profile data.Most clients share this as a standard metadata XML file — the same format ActiFi uses. If your IdP supports metadata export, that's the easiest path.
How implementation works
Step 1 — Both Teams Identify a unique identifier such as Username or Tenant Specific ID and ensure all users in scope for SSO have an identifier populated in SuccessPro.
Step 2 — ActiFi Enable your SSO endpoint and send you metadata XML files for both DEV and PROD environments, containing our system location, required attributes, and public certificate.
Step 3 — Your team Configure ActiFi as a trusted service provider in your identity system using the metadata files we send. Share your equivalent metadata (URLs + certificates) with us by email — no sensitive data is included.
Step 4 — ActiFi Finalize configuration on our end, including Relay State setup to control where users land after authenticating.
Step 5 — Both teams Test the integration in DEV, verify the experience end-to-end, and sign off before enabling in PROD.
⏱ Typical timeline: 2–3 weeks. ActiFi moves as fast as your tech team can.