Set Up SAML SSO

SAML 2.0 is the XML-based single sign-on standard most enterprise identity providers (IdPs) support. You exchange two sets of values: CloudThinker’s service provider (SP) details go into your IdP, and your IdP’s details go back into CloudThinker.

Prerequisites

An organization on the Scale, Scale Plus or Enterprise plan.
The organization Owner role and a verified email domain. See Set up single sign-on.
Admin access to your identity provider.

What you exchange

The wizard at Admin Settings → Identity and access → Setup SSO → SAML 2.0 has three steps: Protocol, SP Metadata and IdP Config.

Direction	Values	Where you find them
CloudThinker → your IdP	ACS URL (Assertion Consumer Service), ending in `/api/v1/sso/saml/acs`, and SP Entity ID, ending in `/api/v1/sso/saml/metadata`	The SP Metadata step, each with a copy button. Both are the same for every connection, so you can copy them before entering any IdP values and send them to your IdP admin.
Your IdP → CloudThinker	IdP Entity ID, SSO URL, IdP Certificate	Your IdP’s SAML app, or its metadata URL. Import takes a URL only; there’s no file upload or pasted XML.
Attributes your IdP sends	Email (required), first name, last name	Your IdP’s attribute mapping

On the IdP Config step, paste your IdP’s metadata URL into the field at the top and click Import. CloudThinker fills IdP Entity ID, SSO URL and IdP Certificate, plus SLO URL and Name ID Format when the metadata includes them.

CloudThinker reads the user’s email from an email, mail, emailAddress or Microsoft emailaddress claim, and falls back to the NameID when it’s an email. If your NameID isn’t an email (for example Persistent or Transient), you must send an email attribute, or sign-in fails. First and last name come from firstName/givenName and lastName/surname.

Configure your provider

Start the wizard, choose SAML 2.0, click Next, and keep the SP Metadata step open while you work in your IdP. Every provider also needs a Display Name on the IdP Config step; any label works, for example Company SSO.

Create a SAML app integration

In the Okta Admin Console, go to Applications → Applications → Create App Integration → SAML 2.0. Name it CloudThinker.

Configure SAML settings

Okta field	Value
Single sign-on URL	CloudThinker’s ACS URL
Audience URI (SP Entity ID)	CloudThinker’s SP Entity ID
Name ID format	`EmailAddress`
Application username	`Email`
Assertion Signature (under Show Advanced Settings)	`Signed`

Add attribute statements

Name	Value
`email`	`user.email`
`firstName`	`user.firstName`
`lastName`	`user.lastName`

Copy the IdP metadata

Save the app. On its Sign On tab, click View SAML setup instructions. Copy the metadata URL, or copy Identity Provider Single Sign-On URL, Identity Provider Issuer and X.509 Certificate.

Assign people in Okta

On the app’s Assignments tab, assign the users or groups who need CloudThinker.

Finish in CloudThinker

Click Next to reach IdP Config. Import the metadata URL, or enter Identity Provider Issuer as IdP Entity ID, Identity Provider Single Sign-On URL as SSO URL, and X.509 Certificate as IdP Certificate. Click Create Connection.

Create an enterprise application

In the Azure portal, go to Microsoft Entra ID → Enterprise applications → New application → Create your own application. Name it CloudThinker, select Integrate any other application you don’t find in the gallery, and click Create.

Set up single sign-on

Open the app, go to Single sign-on → SAML, and edit Basic SAML Configuration:

Entra field	Value
Identifier (Entity ID)	CloudThinker’s SP Entity ID
Reply URL (Assertion Consumer Service URL)	CloudThinker’s ACS URL

Save.

Check attributes and claims

Entra’s default claims (emailaddress, givenname, surname) work as-is. Confirm emailaddress maps to user.mail and that your users have the mail attribute set.If some users have no mail attribute (common for cloud-only accounts), map emailaddress to user.userprincipalname instead. That only works when every UPN is on a verified domain.

Check the signing option

Under SAML Certificates, click Edit and set Signing Option to Sign SAML assertion or Sign SAML response and assertion. Sign SAML response alone fails.

Copy the federation metadata

Under SAML Certificates, copy the App Federation Metadata Url. Alternatively, download Certificate (Base64) and copy the Login URL and Microsoft Entra Identifier.

Assign users and finish in CloudThinker

Assign users or groups under Users and groups. In CloudThinker’s IdP Config step, Import the metadata URL, or enter the Entra Identifier as IdP Entity ID, the Login URL as SSO URL, and the Base64 certificate as IdP Certificate. Click Create Connection.

Create a custom SAML app

In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name it CloudThinker and click Continue.

Copy Google's IdP details

On Google Identity Provider details, copy the SSO URL, Entity ID and Certificate, or download the metadata. Click Continue.

Enter CloudThinker's SP details

Google field	Value
ACS URL	CloudThinker’s ACS URL
Entity ID	CloudThinker’s SP Entity ID
Name ID format	`EMAIL`
Name ID	Basic Information > Primary email
Signed response	Leave unchecked. Google signs the assertion by default.

Click Continue.

Map attributes

Google Directory attribute	App attribute
Primary email	`email`
First name	`firstName`
Last name	`lastName`

Click Finish. Then turn User access to ON for everyone, or for the organizational units that need CloudThinker.

Finish in CloudThinker

Google offers a metadata file, not a URL, and Import only takes a URL, so enter the values by hand. On the IdP Config step, enter Google’s Entity ID as IdP Entity ID, its SSO URL as SSO URL, and its certificate as IdP Certificate. Click Create Connection.

Add a custom SAML application

In the AWS console, go to IAM Identity Center → Applications → Add application → I have an application I want to set up → SAML 2.0. Name it CloudThinker.

Copy the IAM Identity Center metadata

Under IAM Identity Center metadata, copy the SAML metadata file URL, or the sign-in URL, issuer URL and certificate.

Enter the application metadata

IAM Identity Center field	Value
Application ACS URL	CloudThinker’s ACS URL
Application SAML audience	CloudThinker’s SP Entity ID

Submit the application.

Map attributes

Open Actions → Edit attribute mappings and add:

Attribute in the application	Maps to	Format
`Subject`	`${user:email}`	`emailAddress`
`email`	`${user:email}`	`unspecified`
`firstName`	`${user:givenName}`	`unspecified`
`lastName`	`${user:familyName}`	`unspecified`

Assign users and finish in CloudThinker

Assign users or groups to the app. In CloudThinker, Import the metadata URL, or enter the issuer URL as IdP Entity ID, the sign-in URL as SSO URL, and the certificate as IdP Certificate. Click Create Connection.

Add a SAML custom connector

In the OneLogin admin portal, go to Applications → Applications → Add App, search for SAML Custom Connector (Advanced), name it CloudThinker, and save.

Configure the connector

On the Configuration tab:

OneLogin field	Value
Audience (EntityID)	CloudThinker’s SP Entity ID
Recipient	CloudThinker’s ACS URL
ACS (Consumer) URL	CloudThinker’s ACS URL
ACS (Consumer) URL Validator	The ACS URL as a regex with dots escaped. For an ACS URL of `https://api.example.com/api/v1/sso/saml/acs`, enter `^https://api\.example\.com/api/v1/sso/saml/acs$`, using the host from the ACS URL you copied
SAML signature element	`Assertion` or `Both`

Add parameters

On the Parameters tab, add email (Email), firstName (First Name) and lastName (Last Name), each with Include in SAML assertion checked.

Copy the IdP details

On the SSO tab, copy the Issuer URL, the SAML 2.0 Endpoint (HTTP) and the X.509 certificate.

Assign users and finish in CloudThinker

Add users on the Users tab. In CloudThinker, enter the Issuer URL as IdP Entity ID, the SAML 2.0 Endpoint as SSO URL, and the certificate as IdP Certificate. Click Create Connection.

Create a SAML app in your provider

Put CloudThinker’s ACS URL in your provider’s “Reply URL”, “ACS URL” or “Recipient” field, and the SP Entity ID in its “Audience” or “Entity ID” field. Send the user’s email as the NameID and as an email attribute, plus firstName and lastName. Sign the assertion.

Fill in IdP Config

Field	What to enter
Display Name	Any label, for example `Company SSO`
IdP Entity ID	Your provider’s entity ID, sometimes called “Issuer”
SSO URL	Your provider’s single sign-on endpoint
IdP Certificate	The X.509 signing certificate, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines
SLO URL (Optional)	Your provider’s single logout endpoint
Name ID Format	Email Address (default). Also offered: Persistent, Transient, Unspecified. With any of these, your IdP must also send an `email` attribute.

Click Create Connection.

Success state: the dialog shows SSO Connection Created and the connection is Active. Next, run the connection test and a test sign-in from Set up single sign-on.

How CloudThinker handles SAML sign-ins

Behavior	What it means for you
Sign-in starts at CloudThinker	Users enter their email on the CloudThinker sign-in page and click Continue with SSO. Opening CloudThinker from your IdP’s app dashboard (IdP-initiated sign-in) is not accepted.
Signed assertions required	Your IdP must sign the SAML assertion. Signing only the outer response isn’t enough.
Clock tolerance of 120 seconds	Assertions are rejected if your IdP’s clock and CloudThinker’s differ by more than two minutes.
Encrypted assertions not supported	CloudThinker has no SP decryption key. Turn off assertion encryption in your IdP, or sign-in fails.
AuthnRequests are unsigned	CloudThinker doesn’t sign the requests it sends. If your IdP requires signed AuthnRequests, turn that requirement off for this app.
No single logout	Signing out of CloudThinker ends only the CloudThinker session. CloudThinker stores the SLO URL but doesn’t send logout requests to your IdP or accept them from it.
One signing certificate	The IdP Certificate field holds one certificate. There’s no secondary certificate, so plan rotations as a cutover. See Rotate the IdP certificate.
SP Metadata URL after creation	Some IdPs can import an SP metadata URL. It appears on Manage → Configuration once the connection exists.

If	Then
Provisioning is Just-in-time	CloudThinker creates the account on the person’s first SSO sign-in, with the Auto-assigned organization role (default Viewer) and Auto-assigned workspaces you set.
The person has a pending invitation	The invitation’s role and workspaces apply instead. If the organization has no free seat, sign-in fails with “This organization has reached its seat limit.”
The person already has a CloudThinker account with the same email	CloudThinker links that account to your IdP. No duplicate is created.
Provisioning is Manual and the person has no account or invitation	Sign-in is refused. Invite them first.
You want IdP groups to decide access	SAML sign-in reads only email and name, not groups. Use SCIM to map groups to workspaces.

Set the provisioning mode and default role in Set up single sign-on.

If your IdP is unavailable

The organization Owner is exempt from Require SSO and can still sign in with an email code. See If your IdP is unavailable for the steps and the mailbox to set up first.

Rotate the IdP certificate

CloudThinker doesn’t warn before the stored certificate expires and doesn’t show its expiry date. Check the date in your IdP and set your own reminder. CloudThinker checks signatures against one certificate, so sign-ins fail between the moment your IdP starts signing with the new certificate and the moment you save it in CloudThinker. Keep that gap to a minute or two.

Prepare the new certificate in your IdP

Create or upload the new signing certificate, but don’t make it active yet. Copy it, including the BEGIN and END lines.

Switch your IdP to the new certificate

Make the new certificate active for the CloudThinker app.

Save it in CloudThinker right away

Open Manage → Configuration on the Single sign-on card, paste the certificate into IdP Certificate, and click Save Changes.

Test

Run the connection test from Manage → Overview, then sign in through SSO in a private window.Success state: the test passes Certificate Valid and the sign-in lands you in CloudThinker.

If something goes wrong, the Owner can still sign in with an email code and fix the certificate.

Troubleshooting

Your IdP reports an invalid ACS or reply URL

The ACS URL in your IdP must match CloudThinker’s ACS URL exactly, including https:// and with no trailing slash. Copy it again from the SP Metadata step or from Manage → Configuration.

'Audience mismatch' or 'Entity ID mismatch'

The audience or entity ID in your IdP must match CloudThinker’s SP Entity ID exactly. The comparison is case-sensitive.

Connection test fails on Certificate Valid

Paste the full certificate, including the BEGIN and END lines, with no extra characters. If your IdP rotated its certificate, paste the new one on Manage → Configuration and click Save Changes. To avoid this next time, follow Rotate the IdP certificate.

'SSO authentication failed. Please try again or contact your administrator.'

CloudThinker shows this one message for every rejected SAML response, so check these in order:

Assertion not signed: your IdP signs only the response. Turn on assertion signing (see your provider’s tab above).
Assertion encrypted: turn off assertion encryption for the CloudThinker app.
Wrong certificate: paste the IdP’s current signing certificate on Manage → Configuration.
Clock drift: your IdP’s clock is more than two minutes off.

Names show as email addresses

Your IdP isn’t sending first and last name. Add firstName and lastName (or givenName and surname) in your provider’s attribute mapping.

Security and trust

Identity and access

Governance

Prerequisites

What you exchange

Configure your provider

How CloudThinker handles SAML sign-ins

If your IdP is unavailable

Rotate the IdP certificate

Troubleshooting

Next steps

Test and require SSO

SCIM provisioning

​Prerequisites

​What you exchange

​Configure your provider

​How CloudThinker handles SAML sign-ins

​What happens on first sign-in

​If your IdP is unavailable

​Rotate the IdP certificate

​Troubleshooting

​Next steps

Test and require SSO

SCIM provisioning

Prerequisites

What you exchange

Configure your provider

How CloudThinker handles SAML sign-ins

What happens on first sign-in

If your IdP is unavailable

Rotate the IdP certificate

Troubleshooting

Next steps