SSO Setup | Zyeon UI

Preview in your theme

ready · OIDC on Microsoft Entra ID, every prerequisite met. 2 of 3 domains verified, test sign-in passed, so the switch is live: it asks first, spells out that 46 of 48 members move to SSO and that 3 of them sit on the unverified domain and would lose access entirely, and makes you type the phrase before it applies.

Single sign-on

Microsoft Entra IDOIDCSetup guide

Ready to enforce

Paste these into Microsoft Entra ID

Copy each value into the OIDC app you created in Microsoft Entra ID. Typing them by hand is how the audience mismatch happens.

Redirect URI

Add it to the app's allowed redirect URIs, scheme and trailing path included.

https://auth.zyeon.ai/sso/oidc/callback/conn_01J8Z3K9QW4T7VBN

Client ID

The identifier this connection sends on every authorization request.

zyeon-sso-01J8Z3K9QW4T7VBN

Discovery document

The .well-known endpoint describing this connection.

https://auth.zyeon.ai/sso/oidc/conn_01J8Z3K9QW4T7VBN/.well-known/openid-configuration

Bring these back from Microsoft Entra ID

Whatever Microsoft Entra ID shows after you save the app goes here.

Issuer URL

Must match the iss claim on every token, exactly.

https://login.microsoftonline.com/9f1c2a70-8b34-4d6e-b0a5-73d92e4c118f/v2.0

Discovery document

The IdP's .well-known/openid-configuration — signing keys are read from the JWKS it names.

https://login.microsoftonline.com/9f1c2a70-8b34-4d6e-b0a5-73d92e4c118f/v2.0/.well-known/openid-configuration

Authorization endpoint

Only needed when the IdP publishes no discovery document.

Not provided yet

Signing key thumbprint

Optional — pin one key instead of trusting whatever the JWKS serves.

Not provided yet

Verify your domains

A TXT record proves this workspace owns the email domain before anyone signs in with it.

2 of 3 verified

northwind.comVerified
Last checked 6 minutes ago
northwind.co.ukVerified
Last checked 6 minutes ago
northwind-labs.comNot verified
Publish this TXT record in the DNS zone for northwind-labs.com, then check it.
Host
_zyeon-verify.northwind-labs.com
Value
zyeon-domain-verification=c40e29b7f6a84d13e5
Last checked 28 minutes ago

Map claims to fields

What arrives in the assertion, and where it lands on our side.

Claim from the IdPemail
Field on our sideemailRequiredLast seen: [email protected]
Claim from the IdPgiven_name
Field on our sidefirstNameLast seen: Dana
Claim from the IdPfamily_name
Field on our sidelastNameLast seen: Okonkwo
Claim from the IdPgroups
Field on our siderolesLast seen: engineering, sso-admins
Claim from the IdPNot mapped
Field on our sidedepartment

Test sign-in passed

A test sign-in completed: the token was signed, inside its validity window, and issued for this connection.

Subject: [email protected]
Token carried: email, given_name, family_name, groups
Clock delta: 2 s behind our clock (tolerance 120 s)

Checked 39 minutes ago

Require SSO for everyone

Everyone can still sign in with a password. Turning this on moves 46 of 48 members to Microsoft Entra ID; 2 exempt members keep password sign-in.

3 of those 46 use an email domain that is not verified, so those members would lose access entirely. For example [email protected], [email protected], [email protected].

ready · SAML on Okta, three prerequisites unmet, so requiring SSO is refused with the list instead of a dead switch. Check DNS verifies the domain; Run test sign-in walks the four verdicts — clock skew, unsigned assertion, missing email claim, then a pass. The email row stays unmapped, so one blocker never clears.

Single sign-on

OktaSAML 2.0Setup guide

In setup

Paste these into Okta

Copy each value into the SAML 2.0 app you created in Okta. Typing them by hand is how the audience mismatch happens.

ACS URL

Where the signed response is posted back. Some consoles call it the Single sign-on URL.

https://auth.zyeon.ai/sso/saml/acs/conn_01J9QF2M8XR5TDHC

SP entity ID

Goes in the AudienceRestriction of every assertion — it must match character for character.

https://auth.zyeon.ai/sso/saml/conn_01J9QF2M8XR5TDHC

SP metadata URL

Import this and the two values above are filled in for you.

https://auth.zyeon.ai/sso/saml/metadata/conn_01J9QF2M8XR5TDHC

Bring these back from Okta

Whatever Okta shows after you save the app goes here.

IdP issuer

The Issuer element carried by every assertion.

http://www.okta.com/exk8w2f4hQTb0x5d7q1r

Federation metadata URL

Preferred: the signing certificate is re-read from here when the IdP rotates it.

https://contoso-fabrik.okta.com/app/exk8w2f4hQTb0x5d7q1r/sso/saml/metadata

Sign-on URL

Where members are sent to authenticate. Only needed without a metadata URL.

Not provided yet

Signing certificate

SHA-256 fingerprint of the certificate the assertion is signed with.

3F:9A:71:0C:BD:24:E8:57:16:AA:C3:90:5D:74:2B:EF:81:60:D9:4C:A7:35:12:F6:0B:98:E4:7D:52:C1:6A:2F

Signing certificate valid until Sep 9, 2026 — 23 days left. Sign-in stops the moment it expires.

Verify your domains

A TXT record proves this workspace owns the email domain before anyone signs in with it.

0 of 1 verified

contoso-fabrik.comNot verified
Publish this TXT record in the DNS zone for contoso-fabrik.com, then check it.
Host
_zyeon-verify.contoso-fabrik.com
Value
zyeon-domain-verification=5b0d9e73c8f142aa17
Never checked

Map claims to fields

What arrives in the assertion, and where it lands on our side.

Claim from the IdPNot mapped
Field on our sideemailRequiredSign-in cannot complete without it.
Claim from the IdPhttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Field on our sidefirstName
Claim from the IdPhttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Field on our sidelastName
Claim from the IdPgroups
Field on our sideroles

No test sign-in yet

Nothing has proved that a member can reach Okta and come back.

Require SSO for everyone

Everyone can still sign in with a password. Turning this on moves 11 of 12 members to Okta; 1 exempt member keeps password sign-in.

11 of those 11 use an email domain that is not verified, so those members would lose access entirely. For example [email protected], [email protected].

3 things still to do before SSO can be required:

Verify at least one domain: until then nothing proves which email addresses this connection is allowed to claim.
Map the required field: email.
Run a test sign-in first: requiring a door nobody has opened yet is how a tenant locks itself out.

loading · skeletons mirroring the real anatomy — two value blocks and the enforcement row — plus an sr-only status line. No copy buttons are drawn for values that are not known yet.

Single sign-on

Federated sign-in for this workspace.

empty · no connection exists, so there are no per-connection values to paste anywhere yet — the panel says why rather than rendering four empty steps. Connect an identity provider is wired: it hands over to the brand-new connection, still in setup.

Single sign-on

Federated sign-in for this workspace.

No identity provider connected

The callback URL and identifiers your IdP needs are minted per connection, so there is nothing to paste anywhere yet. Create the connection first — members keep signing in with a password until you require SSO.

error · the configuration could not be read, and the payload's own message says what happened. Try again is wired — clicking it swaps this panel to the ready state.

Single sign-on

Federated sign-in for this workspace.

Couldn't load the SSO configuration

The identity service did not answer (504 after 10 s). Nothing was changed — members can still sign in.

Loading preview…

This component is part of Pro

The install command, prompt and concept map are included with a Pro license — one purchase unlocks every Pro component, forever.

Unlock with Pro