Bromcom - Seemless sign on direct link

[DrCheese]

Hi all,

 

Proper first world problem here, but is there a link/shortcut we can use to seemless sign people in?

It's a pain to go to https://cloudmis.bromcom.com/ & then click "Login with Microsoft"

 

I just want staff to be seemlessly signed in, like when they hit emails.

 

I would just link to the link that the Logon with Microsoft button, but the hyperlink changes each time.

[jthompson]

I've not found a way for this to work, no. The entry for Bromcom SSO in the list of enterprise aplications in Entra doesn't appear to offer anything useful by way of URLs, either.

 

There doesn't appear to be any provision for setting Bromcom up as a SAML app, either, unless anyone on here knows different?

[Rob_D]

We just copied the link from teh Logon with Microsoft button. It's worked pretty reaibaly for us for the last couple of years.

[jthompson]

7 minutes ago, Rob_D said:

We just copied the link from teh Logon with Microsoft button. It's worked pretty reaibaly for us for the last couple of years.

For me, I see the session ID in the URL changing with each refresh of the sign-in page, so was hesitant to reuse it in case it confised something. I may have tried the same with the Google button and found that it didn't work (can't remember now).

[DrCheese]

4 hours ago, jthompson said:

For me, I see the session ID in the URL changing with each refresh of the sign-in page, so was hesitant to reuse it in case it confised something. I may have tried the same with the Google button and found that it didn't work (can't remember now).

 

Aye that's why I wasn't sure if doing that would break it - I tried to remove everything forward of the SSO provider but doing so break it (eg)

https://services.bromcom.com/CommunicationServer/Customer/AuthenticationService/OAuthLogon.aspx?SSOProvider=Microsoft

 

I've done a test link on the IT intranet based on @Rob_D's findings so will see how that goes for a few days.

 

Shame there's no supported way for this listed (Office just does domain hints so it's easy!)

 

[BlackCat80]

Just use the full link on the button itself. That worked for me. That's how we implemented for our school's intralinks

https://services.bromcom.com/CommunicationServer/Customer/AuthenticationService/OAuthLogon.aspx?SSOProvider=Microsoft&SSOAccessKey=cDq7b8%2fuM8lUjh6aI56NltjiU7IZQXJKoWsOynNTkLWKVudD4sJ5DMLUgBPh1pSfxU2P9n3fTxiJ0bD8SdpJCziYIEP%2fUfa4JdDUY%2fQtdLn8sngIB7CvHidmI%2fLW2PrDmYH%2b6mTQiJHsHZwz%2bfEDf%2bVZKZRbta7Lxp0YNF9UNDJRSpoqyObhJgDS4n1SsPygg3jM8VknPfzKxc%2bFikXUQw%3d%3d

Edited April 16 by BlackCat80

[psynegy]

It was logged as Idea BRCM-I-5415 on the ideas portal 2 years ago, but they apparently didn't like the idea - so have since deleted it.

[ThomL]

21 hours ago, BlackCat80 said:

Just use the full link on the button itself. That worked for me. That's how we implemented for our school's intralinks

https://services.bromcom.com/CommunicationServer/Customer/AuthenticationService/OAuthLogon.aspx?SSOProvider=Microsoft&SSOAccessKey=cDq7b8%2fuM8lUjh6aI56NltjiU7IZQXJKoWsOynNTkLWKVudD4sJ5DMLUgBPh1pSfxU2P9n3fTxiJ0bD8SdpJCziYIEP%2fUfa4JdDUY%2fQtdLn8sngIB7CvHidmI%2fLW2PrDmYH%2b6mTQiJHsHZwz%2bfEDf%2bVZKZRbta7Lxp0YNF9UNDJRSpoqyObhJgDS4n1SsPygg3jM8VknPfzKxc%2bFikXUQw%3d%3d

 

The &SSOAccessKey part of that URL updates with every visit to the Bromcom login page - it wouldn't seem to be a good idea to use the same key repeatedly?

 

 

On 15/04/2026 at 19:07, DrCheese said:

 

Aye that's why I wasn't sure if doing that would break it - I tried to remove everything forward of the SSO provider but doing so break it (eg)

https://services.bromcom.com/CommunicationServer/Customer/AuthenticationService/OAuthLogon.aspx?SSOProvider=Microsoft

 

I've done a test link on the IT intranet based on @Rob_D's findings so will see how that goes for a few days.

 

Shame there's no supported way for this listed (Office just does domain hints so it's easy!)

 

 

The link without the access key throws an error message when I've tried it 😬

Edited April 17 by ThomL

[ThomL]

I made a proof of concept - you can use JS to get the Bromcom login webpage, then harvest the link from this page.

Run this JS each time the page loads (page you wish to link to the Bromcom SSO Login), a fresh unique link each time. It's not the best approach - would be nicer for Bromcom to expose a service for this we could link directly to, or an API that could be queried directly to return the link.

 

The only issue with this proof of concept is CORS... this example will likely work for a few page loads/refreshes and then it will be rate limited for you as it's using a free CORS proxy. If someone want to implement this they might want to reach out to this CORS proxy provider Free CORS Proxy for Education – Universities & Students to try an get free access or setup their own CORs proxy and then tweak the code to run the requests through the new proxy.

 

 

Here it is in action: https://jsfiddle.net/j403qt1x/

Or here's the single page HTML, copy/paste/save as a .html file to try it out from local host.

<!DOCTYPE html>

<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Bromcom Link Extractor</title>
  <style>
    body {
      font-family: Arial, sans-serif;
      padding: 20px;
    }
    button {
      padding: 10px 15px;
      font-size: 16px;
      cursor: pointer;
    }
    #result {
      margin-top: 20px;
      font-weight: bold;
      color: blue;
      word-break: break-all;
    }
  </style>
</head>
<body>

  <h2>Extract Microsoft SSO Link from Bromcom Login Page</h2>
  <button onclick="getLink()">Refresh Link</button>
  
  <h3>Link:</h3>
  <div id="result">Result will appear here...</div>
  
  <script>
    async function getLink() {
      const resultDiv = document.getElementById('result');
      resultDiv.textContent = "Loading...";

      try {
        const response = await fetch('https://api.codetabs.com/v1/proxy?quest=https://cloudmis.bromcom.com/Nucleus/Framework/Login.aspx');
        const html = await response.text();

        const parser = new DOMParser();
        const doc = parser.parseFromString(html, 'text/html');

        const linkElement = doc.getElementById('btnLinkMicrosoftAccount');

        if (linkElement && linkElement.href) {
          resultDiv.innerHTML = '<a href="' + linkElement.href + '" target="_blank">' + linkElement.href + '</a>';
        } else {
          resultDiv.textContent = "Link not found.";
        }

      } catch (error) {
        resultDiv.textContent = "Error: " + error.message;
      }
    }
	
    document.addEventListener("DOMContentLoaded", () => {
	  getLink();
    });
  </script>

</body>
</html>