SSO Providers

Under Authentication → SSO Providers, this page configures which identity providers can sign users into an organization. For the full hands-on walkthrough — adding a provider, signing in, and approving the first user — see the OIDC setup guide.

SSO Providers

Select an organization, then Add provider. Pending users opens the same approval queue as Users → Pending SSO.

• Filter by Organization — defaults to All organizations. With no organization selected in contexts that require one: Select an organization / Pick an organization above to list its SSO provider configurations.
• Pending users — opens the approval queue (same as Users → Pending SSO).
• Add provider — disabled until an organization is selected in the filter when the create flow requires one (Select an organization in the filter above before adding a provider.).
• Empty list — No SSO providers configured / Add a provider to let users sign in via Google, Microsoft Entra, Jumpcloud, or any OIDC-compliant IdP.
• Table columns — Name, Organization, Type, Client ID, Status, Last used, Actions. Status is Active or Disabled; Last used shows Never until the first successful sign-in.

SSO Providers — list

Status, Last used, and per-row actions: test the configuration live, view, edit, or delete.

The row’s test action dry-runs the full configuration without touching a real user session.

The form has three sections — Identity, OIDC discovery, and Credentials — plus Endpoints, Advanced, and Identity linking further down:

New SSO provider — Identity and OIDC discovery

Provider type: Generic OIDC, Generic OAuth2, Google, GitHub, or Microsoft. Issuer URL + Discover endpoints auto-fills the endpoints below from the IdP's discovery document.

New SSO provider — Endpoints and Advanced

Callback URL, Scope, allowed email domains/origins, and Auto-link by email under Identity linking.

• Enabled — providers are created disabled. Disabled providers stay in the database but disappear from the login page immediately.
• Discover endpoints — fetches the IdP’s .well-known/openid-configuration and fills Authorization/Token/User info/JWKS/End session URL. Every field it fills stays editable.
• Client secret — encrypted at rest, shown only once at creation.
• Auto-link by email — off by default. On: a verified-email match to an existing CYPEX user links silently. Off: every new identity requires admin approval regardless of email match.

Form buttons: Create provider (create) / Save changes (edit), and Cancel.

Pending users opens the same Users → Pending SSO tab documented on Users — a successful IdP login with no matching role mapping sits there until an admin approves it (and picks a PostgreSQL role) or rejects it.

• OIDC setup guide — end-to-end walkthrough with real screenshots, the JWT claim table, and troubleshooting.
• SSO (architecture) — coexistence with local auth and the multi-provider-per-org model.
• LDAP — the other federated login path, directory-backed rather than OIDC.
• Users — Active users / Pending SSO / Rejected SSO tabs.
• Setup guide — connect an IdP in step 3 of first-run setup.