v2.0.0 redesigns the login screen. This page describes it from the user’s side: what you see, what to type, and what the messages mean. Administrators configuring providers should start at SSO providers (OIDC) instead.
Two ways in, on one screen:
- Username / Email and Password — sign in with your CYPEX account.
- Or quick sign in: — sign in through your organization’s identity provider (Google, Microsoft Entra, and others), if one is configured.
Login screen with the organization picker open
Choosing an organization under Or quick sign in reveals that organization's sign-in buttons.
Type your username or email address, then your password, then Login.
The screen adapts as you type. Enter an email address whose domain is federated and CYPEX resolves the matching identity provider for you — you do not have to know which one your organization uses. Enter a plain username and you stay on password sign-in.
Under Or quick sign in:, pick your Organization. The organization’s enabled sign-in buttons appear.
Provider button for the selected organization
Each organization exposes its own providers — more than one can be enabled for the same organization.
Click the provider and you are handed to it to authenticate. Google, Microsoft Entra, and JumpCloud show their own logo; every other provider shows a generic sign-in icon. The icon says nothing about whether the provider works — it is cosmetic.
Identity provider consent screen
Authentication happens at your identity provider, not in CYPEX.
Providers are configured per organization, so two business units on the same CYPEX deployment can federate with completely different identity providers.
| Message | What it means |
|---|---|
| No organizations have SSO configured. | Nobody on this deployment uses federated login. Sign in with username and password. |
| This organization has no active SSO providers. | That organization uses password sign-in, or its provider is switched off. |
| Could not load SSO options. Please try again. | A transient problem loading the list. Retry; if it persists, tell your administrator. |
A successful sign-in at your identity provider does not by itself give you access to CYPEX. Unless your administrator has set up a rule that matches you automatically, you land in one of two states.
Your identity was verified. An administrator must assign a role before you can sign in.
Your identity provider confirmed who you are, and CYPEX has created a pending record for you. An administrator has to approve it and give you a role.
What to do: contact your organization administrator, then sign in again once you are approved.
Your identity was verified, but no role is configured for your account yet.
Same situation, different cause: you got past the approval gate but no role has been assigned, so there is nothing you are allowed to do.
What to do: ask your organization administrator to configure a role for your account. If a Reference code is shown on the screen, include it — it lets the administrator find your exact sign-in attempt in the audit trail.
InfoThis gate is deliberate, not a fault. An identity provider your company federates with can create accounts; the approval step is where CYPEX decides whether such an account becomes a CYPEX user. See User lifecycle.
Your session lasts for a period your administrator configures. CYPEX renews it quietly in the background while you work, and signs you out when the session ends or when an administrator revokes your access. Signing out in one browser tab signs you out in the others.
If your account is deactivated or your role changes, the change takes effect within minutes rather than at the end of your session — see Sessions and tokens for the mechanism.
- User lifecycle — pending, active, and rejected identities, from the administrator’s side.
- SSO providers (OIDC) — configuring a provider.
- LDAP — directory-backed sign-in.
- Single Sign-On — the SSO architecture.