Single sign-on (SSO) lets your team use your company's identity provider, such as Okta, Entra ID, Google Workspace or Auth0. It's included on Professional.
Choose a protocol
Open SSO / Identity and choose SAML 2.0 or OIDC.
SAML 2.0
Give your identity provider these values, using your Company ID:
| Field | Value |
|---|---|
| ACS URL | https://kloudsentinel.com/api/auth/saml/acs |
| Entity ID and metadata | https://kloudsentinel.com/api/auth/saml/metadata?tenant=YOUR_COMPANY_ID |
| Name ID | The user's email address |
Then enter your provider's details in KloudSentinel:
- Identity provider entity ID
- Sign-in URL
- Signing certificate
OIDC
- Create an application with your provider, and add the redirect URI shown on the page.
- Enter the Client ID, Client Secret and discovery URL.
Test before you rely on it
- Enable SSO and test the connection.
- Sign in from a private browser window, leaving your admin session open.
- Keep one password-based admin account for emergencies.
For SAML, the connection test only checks your settings. A real sign-in confirms them.
How users are matched
Users are matched by email. If auto-provisioning is off, each person needs an existing account. If it's on, a first sign-in creates one.
Troubleshooting
Sign-in started from the provider's dashboard fails
KloudSentinel only accepts sign-ins that start from its own login page. Start from https://kloudsentinel.com/login.
"No account" error
The user's email doesn't match an account. Add the user, or turn on auto-provisioning.
SAML sign-in is refused
Check that the ACS URL and entity ID match exactly, that your provider sends the email address, and that the certificate is current.