✅ Completed: SSO Login Required for developers.healthsafepay.com
Completed Date: Thursday, July 9, 2026
Team: CCG Platform
Status: ✅ Completed
Owner: Syamala
Single Sign-On (SSO) is now enforced on developers.healthsafepay.com via your Optum / Azure AD identity. Users who are not in the approved access group cannot log in.
📋 What Changed?
On Thursday July 9, SSO login enforcement was completed on developers.healthsafepay.com.
Visiting the site will automatically redirect to the Microsoft login page. After authenticating with your Optum identity, you will be returned to the docs site as normal.
💡 Why Are We Doing This?
| Reason | Detail |
|---|---|
| Internal content protection | The developers site contains internal integration docs, engineering guides, and operational details not intended for public access. |
| Identity-based access control | SSO ties access to your Optum identity, making it easy to grant and revoke access via Entra ID group membership. |
| Consistent with other internal apps | Other CCG internal tools (e.g. test-reports) already use the same Azure AD PKCE pattern. |
🔖 Access Requirements
To access the site after SSO is enabled, your Optum account must be a member of the security group:
AZU_CCG_INTERNAL_DOCS_Users
If you need access, contact your team lead or the CCG Platform team to be added to the group.
Adding a user to AZU_CCG_INTERNAL_DOCS_Users in Entra ID grants them immediate access. No code changes or deployments needed.
🌐 Scope
| Site | After SSO Rollout |
|---|---|
developers.healthsafepay.com | 🔐 SSO required — Optum login enforced |
docs.healthsafepay.com | ✅ Remains fully public — no login required |
✅ What You Need To Do Now
- Ensure your Optum Azure AD account is active.
- Ask your team lead to add you to
AZU_CCG_INTERNAL_DOCS_Usersif you are not already a member. - No browser or local tooling changes are required.
🛠 Technical Details
| Field | Value |
|---|---|
| Identity Provider | Microsoft Entra ID (Azure AD) |
| Enterprise App | Stage-IAMSSO-OIDC-SS-CCG-Microsite-Internal-app |
| Client ID | 1da39382-3759-4268-9ede-a9ebfa019abc |
| Auth Flow | OAuth 2.0 Authorization Code + PKCE (S256) |
| Token Storage | sessionStorage (client-side only) |
| Redirect URI | https://developers.healthsafepay.com/oauth2/callback/ |
| Authorization Endpoint | https://login.microsoftonline.com/db05faca-c82a-4b9d-b9c5-0f64b6755421/oauth2/v2.0/authorize |
| Token Endpoint | https://login.microsoftonline.com/db05faca-c82a-4b9d-b9c5-0f64b6755421/oauth2/v2.0/token |
| JWK Endpoint | https://login.microsoftonline.com/db05faca-c82a-4b9d-b9c5-0f64b6755421/discovery/v2.0/keys |
| Scopes | openid profile email offline_access api://1da39382-3759-4268-9ede-a9ebfa019abc/openid |
| Required Group | AZU_CCG_INTERNAL_DOCS_Users |
❓ Common Errors
| Error | Cause | Fix |
|---|---|---|
AADSTS50105 | Account not in AZU_CCG_INTERNAL_DOCS_Users or group not assigned to the app | Ask your team lead to add you to the group |
AADSTS53003 | CA policy block | Use client-side MSAL — already the current architecture |
| Blank page after login | Callback not handled | Clear sessionStorage and try again |
📚 Resources
| Resource | Link |
|---|---|
| SSO Integration Plan | View Plan |
| Entra ID Group Management | (Azure Portal → Entra ID → Groups → AZU_CCG_INTERNAL_DOCS_Users) |
| Developers Site | developers.healthsafepay.com |
| Public Docs Site | docs.healthsafepay.com |
🏁 Bottom Line
SSO login is now required for
developers.healthsafepay.com— access via your Optum identity.
Ensure your account is inAZU_CCG_INTERNAL_DOCS_Usersto access the site.
docs.healthsafepay.comremains fully public — no login required.