SAML

Configure a generic SAML provider as the Single Sign-On provider for your organization on the Akuity Platform.

Configuring SAML SSO

info

Akuity Platform SSO is available on Enterprise plans only. Please contact our Sales Team to access the feature.

The owner role on the Organization is required to configure SSO.

1. Go to Organization > SSO.

   

2. Click Add Configuration.

3. Create an OIDC Application.

   • Set Allowed Callback URL to https://auth.akuity.io/login/callback?connection={your organization id}

   • Set Entity ID to urn:auth0:akuity:{your organization id}

   • Organization ID can be found in the top-right side of the Organization page.

     

4. Populate the configuration details on the form.

   • Domain: Your organization's domain name
   • Domain Aliases: Additional domains to match organization members (e.g. some-org.com).
   • Configuration (XML): Use Metadata XML to configure SAML SSO.
   • Configuration (Manual): Manually configure SAML SSO.
     • Sign-In Endpoint: SAML single login URL.
     • Disable Sign-out: When disabled, a specific Sign Out URL can be set.
     • Sign-Out Endpoint: SAML single logout URL.
     • Sign Request: When enabled, the SAML authentication request will be signed.
     • Signature Algorithm: Algorithm to use to sign the SAML assertions.
     • Digest Algorithm: Algorithm to use to the sign request digest
     • Base64 Encoded Signing Cert: Base64 encoded signing certificate
     • Protocol Binding: HTTP binding supported by the IdP
   • IdP Initiated SSO: When enabled, users can log in directly from their Identity Provider without first visiting the Akuity Platform.

Security Risk: IdP-Initiated SSO

Auth0, the identity provider powering Akuity Platform authentication, does not recommend enabling IdP-Initiated SSO.

In an IdP-Initiated flow, Auth0 receives an unsolicited response from the IdP and the application receives an unsolicited response from Auth0. Neither entity can verify that the user actually started the flow. This opens the possibility of a Login CSRF attack, where an attacker can trick a legitimate user into unknowingly logging into the application with the identity of the attacker.

Whenever possible, keep this disabled and let authentication be initiated from the Akuity Platform (the default). Only enable this if your IdP requires initiating the login flow and you understand the risks involved.

note

For security purposes, your domain and domain aliases will be submitted to Akuity for manual review and approval.

IDP Groups Mapping

caution

IDP Groups does not work for Okta native integration as Okta does not support groups claim. Please use generic SAML/OIDC option instead to connect with Okta if you want to use this feature.

To configure IDP Groups for an Organization in the Akuity Platform:

1. Go to Organization > SSO.

   

2. Click Add New Rule.

   

3. In the Add OIDC Group Mapping select the role and specify the corresponding OIDC Group for your provider.

   

4. Click the Add button.

note

In the SSO settings, if the Auto Add Member is checked the new user will join your organization with the member role automatically.

OIDC Team Mapping

caution

OIDC Team Mapping does not work for Okta native integration as Okta does not support groups claim. Please use generic SAML/OIDC option instead to connect with Okta if you want to use this feature.

This feature allows you to map users with a specific OIDC group to a team in your organization.

Your organization must have at least one Team.

To configure this feature for an Organization in the Akuity Platform:

1. Go to Organization > SSO.

   

2. Scroll down to the "OIDC Team Mapping" section and click Add New Mapping.

   

3. In the modal that appears, specify an OIDC group and select an existing team from the dropdown.

   

4. Click the Add button.

Now, when a user logs in with the specified IDP group, they will be added to the selected team in your organization.