Connecting your identity provider (SSO)

Single sign-on (SSO) lets your team log in with your existing identity provider (IdP) such as Okta, Entra ID (Azure AD), or Google Workspace. CybAura supports both SAML 2.0 and OIDC. SSO is available on the Enterprise plan.

Before you start

You'll need administrator access to both CybAura (Settings → SSO) and your identity provider.

Option A — SAML 2.0

1. In CybAura, go to Settings → SSO and select SAML.
2. Copy the ACS (Reply) URL and Entity ID shown.
3. In your IdP, create a new SAML application and paste those values.
4. Map the required attributes: email, firstName, lastName. Optionally map a groups attribute for role assignment.
5. Copy your IdP's metadata URL (or upload the metadata XML) back into CybAura.
6. Select Save, then use Test connection to verify a round-trip login.

Option B — OIDC

1. In CybAura, select OIDC under Settings → SSO.
2. Copy the Redirect URI.
3. In your IdP, register a new OIDC/OAuth application with that redirect URI.
4. Paste the Client ID, Client Secret, and Issuer URL into CybAura.
5. Save and run Test connection.

Enforcing SSO

Once SSO is verified, you can require it for all members under Settings → SSO → Enforcement. We recommend keeping one break-glass administrator with password access in case of IdP outage.

Provisioning with SCIM

If your IdP supports SCIM, enable it to automatically create, update, and deactivate users. Generate a SCIM token under Settings → SSO → Provisioning and add it to your IdP.

Troubleshooting

• Login loops or "no email attribute" — check your attribute mappings; email is required.
• Certificate errors — re-import the IdP metadata; signing certificates may have rotated.
• See Common issues and how to resolve them for more.