Authdog
Back to journal
Identity ArchitectureEnterprise SSOAuthentication

Guided enterprise SSO setup

Enterprise identity connections can now be configured through a guided console flow.

From the changelog: Expanded enterprise SSO setup

Authdog Team

2 min read
Centered Authdog mark with an angled SSO word plate on a grainy navy wash with dashed federation rings

Enterprise customers expect to sign in with their own identity provider. Wiring SAML or OIDC by hand is slow and easy to mis-copy. Authdog now walks those connections through a guided console flow, with provider-specific setup for the vendors teams already run.

This is the longer note behind the July 11 changelog entry.

How it works

The authentication console includes first-class setup for:

  • Microsoft Entra ID
  • Okta
  • Ping Identity
  • JumpCloud
  • BeyondTrust

The flow covers SAML metadata discovery (URL fetch or pasted XML) and email-domain routing, so a user who types [email protected] is sent to the connection that owns that domain. Connection settings and status stay visible on the authentication providers list so you can see what is configured, active, or still incomplete.

Generic SAML 2.0 and OpenID Connect connectors remain available when the IdP is not one of the first-class vendors. Protocol details are in Enterprise SSO.

Set it up

In the Authdog console, open Authentication > Providers and filter to Enterprise:

  1. Choose the vendor connector.
  2. Copy Authdog's service-provider values into the IdP.
  3. Import IdP metadata or enter the IdP URL, certificate, and connection name.
  4. Add the email domains that should discover this connection.
  5. Save, then use Test before inviting users.

Keep discovery domains non-overlapping across connections in the same environment. Resolution uses the first active match.

Trust boundaries

SSO authenticates the user through the IdP you configured. It does not provision directory membership by itself; use SCIM when the IdP should create and deactivate users. A saved connection that is not active does not participate in domain discovery.

Authdog trusts the IdP assertion or token for that connection. Wrong ACS, audience, or certificate values fail the handshake; they do not fall through to password sign-in for that domain unless you also offer a non-enterprise method.

Try it

Product overview is on Integrations. Setup steps are in Enterprise SSO. The original release note is in the changelog.

More from Authdog
ShareLinkedInX