> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# ConnectWise Home

You can configure ConnectWise Home to use IDaaS for multifactor authentication. ConnectWise Home is a business process automation platform (see <https://www.connectwise.com/>). This integration provides instructions to integrate ConnectWise Home with IDaaS. Once integrated, users can use single sign-on to log in to their ConnectWise account using IDaaS.

warning

This integration was tested using IDaaS version 5.30 and ConnectWise Home build 23.4.3.8545. Other versions of the ConnectWise Home may require integration and configuration steps that differ from those documented in this procedure. For other versions of ConnectWise Home, use this procedure as a starting point for integrating ConnectWise Home. In the event of other issues, contact <support@entrust.com> for assistance.

## Integrate ConnectWise Home with IDaaS

To integrate ConnectWise Home with IDaaS, complete the following steps:

- [Step 1: Copy the Redirect URI from ConnectWise](#step-1-copy-the-redirect-uri-from-connectwise)
- [Step 2: Configure the General settings in IDaaS](#step-2-configure-the-general-settings-in-idaas)
- [Step 3: Configure customizations](#step-3-configure-customizations)
- [Step 4: Add a resource rule](#step-4-add-a-resource-rule)
- [Step 5: Optional. Add a resource server](#step-5-optional-add-a-resource-server)
- [Step 6: Copy the OIDC configurations from IDaaS](#step-6-copy-the-oidc-configurations-from-idaas)
- [Step 7: Add IDaaS to ConnectWise](#step-7-add-idaas-to-connectwise)
- [Step 8: Test the integration](#step-8-test-the-integration)

note

Before you begin, open two browser windows. In one window, log in to your ConnectWise Home administrator account. In the other window, log in to your IDaaS administrator account.

### Step 1: Copy the Redirect URI from ConnectWise

1. In ConnectWise, click Users icon to display the **User & Applications Settings** page.
2. In the navigation pane, click **Authentication > Add Provider > Add Login Provider**. The **Add Login Provider** page appears.
3. Copy and save the **Redirect URI** to a text file, such as Notepad.
4. Leave this page open. You return to it in _Step 7: Add IDaaS to ConnectWise Home_.

### Step 2: Configure the General settings in IDaaS

1. In IDaaS, click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

2. Click **Add**. The **Select an Application Template** page appears.

3. Do one of the following:

   - Click **OIDC** and select **ConnectWise Home** from the list of **OpenID Connect and OAuth Cloud Applications**.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

4. Click **ConnectWise Home**. The **Add ConnectWise Home** page appears.

5. If required, modify the following **App Settings**:

   - **Application Name**
   - **Application Description**

6. Configure the **OIDC Settings**.

   1. Copy and save the **Client ID** in a text editor, such as Notepad. You need this value for _Step 7: Add IDaaS to ConnectWise Home_.

   2. Set the **Reauthentication Time (Max Authentication Age)** to the maximum amount of time that can elapse before a user must reauthenticate to log in. This feature is disabled if the field is left blank.

   3. Select the **OIDC Signing Certificate** used to connect to ConnectWise Home.

   4. From the **ID Token Signing Algorithm** drop-down list, select **RS256** as the signing algorithm used to sign with ID Token during authentication.

   5. From the **User Info Signing Algorithm** drop-down list, select **RS256**.

   6. From the **Access Token Signing Algorithm** drop-down list, select **RS256**.

   7. Click **Add** next to **Login Redirect URIs**.

   8. In the **Add Login Redirect URI** field, enter the Redirect URI that you copied in _Step 1: Copy the Redirect URI from ConnectWise_.

   9. Do not modify the **Supported Grant Types**.

   10. From the **Authorization Code PKCE Code Challenge Method** drop-down list, select **S256** as the method used with PKCE during authentication.

   11. Do not modify the current setting for the **Subject ID Attribute** that is included in the ID token and access token to identify the user being authenticated.

   12. Select **Require Consent** to require that users respond to a consent prompt for each request.

   13. Optional. Enter a **Custom Consent Message** to include a message to users when consent is requested.

   14. The authorization request uses **Supported Scopes** to establish a connection between IDaaS and the ConnectWise OIDC application. Supported Scopes are selected by default. If you disable **Your unique identifier**, the ConnectWise OIDC application strictly uses an access token to access a resource server API on behalf of a user.

   note
   Click the arrow next to each scope to see the list of **Implied Claims** included in the scope. The list of **Implied Claims** is defined by OpenID Connect and cannot be modified. Every Implied Claim included in the scopes you select under **Supported Scopes** should have an associated IDaaS user attribute so that the attribute is returned as part of the OIDC tokens sent back to the client. For example, if you select Address as a Supported Scope, then you must define an IDaaS user attribute for each **Implied Claim** associated with Address. See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).

7. Configure the **Advanced Settings**.

   1. Select **Enable Organizations and Domain-Based Identity Providers** to allow organization information to be returned in OIDC claim values when users log in. When enabled, if users are associated with more than one organization and an organization has not been requested, users can select their organizations after they authenticate to their application.

   note
   When organizations are enabled, the corresponding OIDC claims must also be configured.

   2. Enter the **Default Resource/Audience Request Value** to include this value as the resource or audience parameter for every authorization request.

   3. Select **Include authentication time** **with all ID tokens** to include the authentication time with all tokens.

   4. From the **ID Token Signing Algorithm** drop-down list, select the signing algorithm that is used to sign the ID tokens during authentication.

   5. Set the **ID Token Timeout** to the time (in minutes) that the ID token is valid before it expires.

   6. From the **Userinfo Signing Algorithm** drop-down list, select the signing algorithm used to sign the user info data during authentication.

   7. Set the **Userinfo Access Token Timeout** to the time (in minutes) that the access token is valid before it expires.

8. Click **Save**.

9. Proceed to _Step 3: Configure customizations._

attention

Do not modify the Claims.

### Step 3: Configure customizations

1. Click the **Customization** tab. The **Customization** page appears.
2. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the application login page to log in.
3. Optional: Select **Respond Immediately for Unsuccessful Responses** to return to the application immediately after a login failure, rather than allow the user to try again with a different user ID.
4. Optional: Deselect **Show Login Redirect URL in My Profile** to hide the application from a user's profile.
5. Optional. Add a custom application logo, as follows:
   1. Click Circle Plus icon next to **Application Logo**. The Upload Logo dialog box appears.
   2. Click Arrow Up From Line icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image.
   4. If required, resize your image.
   5. Click **OK**.
6. Select the **Login Options** that appear to users during login. You must select at least one. For details on each login option and requirements, see [Manage login options](/docs/applications-and-sso/manage-applications/manage-login-options.md).
7. Click **Save**.
8. Proceed to _Step 4: Add a resource rule._

### Step 4: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

### Step 5: Optional. Add a resource server

1. Click the **Resource Servers** tab.
2. Click **Add Resource Server**.
3. Follow the instructions in [Add an API/URL resource server](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/add-an-api-url-resource-server.md).

### Step 6: Copy the OIDC configurations from IDaaS

1. In IDaaS, click Menu icon **>** **Resources > Applications**. The **Applications List** page appears.
2. Under **OpenID Connect and OAuth Integrations**, click **OIDC Configuration**.
3. Copy the **Issuer** URL to a text file, such as Notepad.
4. Click **OK** to close the **OIDC Configuration** dialog.

### Step 7: Add IDaaS to ConnectWise

1. Return to the ConnectWise Home browser window that displays the **Add Identity Provider** page.
2. Enter a **Display Name**, for example, `EntrustOIDC`.
3. Enter the **Client ID** you copied in _Step 2: Configure the General settings_.
4. In the **Authority URL** field, enter the Issuer URL you copied in _Step 6: Copy the OIDC configurations from IDaaS_.
5. In the **Response Type** drop-down list, select **id_token**.
6. Click the **Users List** tab. The **Add Login Provider** page appears.
7. Check **Select All**.
8. Click **Save**. The **ConnectWise Configuration Details** appear.

### Step 8: Test the integration

Test the integration between your ConnectWise Home and IDaaS accounts to confirm that your settings have been configured correctly.

#### Test Service Provider login

1. Open a Web browser and enter the URL for your ConnectWise Home account.
2. Click **Sign in with ConnectWise**.
3. Enter your **ConnectWise Home** account email address and then click **Next**. You are redirected to IDaaS.
4. Enter your IDaaS user ID and then respond to the second-factor authentication.
5. Click **Accept** on the dialog box.

#### Test IDaaS redirect login

1. Log in to your IDaaS Account.
2. Go to your **My Profile** page if you are not already there.
3. Under **Applications**, click **ConnectWise Home OIDC**.
4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to ConnectWise Home.