Connect Google Workspace, Microsoft Entra ID, AWS IAM Identity Center, Okta, OneLogin, or any SAML 2.0 identity provider
Set up SAML 2.0 single sign-on between your identity provider and CloudThinker. Start the wizard at Admin Settings → Identity and access → Setup SSO and choose SAML 2.0; the SP Metadata step shows the ACS URL, SP Entity ID, and SP Metadata URL you paste into your provider.
A verified email domain and an eligible plan — see Single Sign-On
Admin access to your identity provider
On the wizard’s IdP Config step, paste your provider’s metadata URL into the Import field to auto-fill IdP Entity ID, SSO URL, and IdP Certificate in one step.
Go to admin.google.com → Apps → Web and mobile apps → Add app → Add custom SAML app. Name it CloudThinker and click Continue.
2
Download the IdP metadata
On the Google IdP information screen, download the IdP metadata XML or note the SSO URL, Entity ID, and the X.509 Certificate. Click Continue.
3
Enter CloudThinker's SP details
Copy the values from CloudThinker’s SP Metadata step:
Google field
CloudThinker value
ACS URL
The ACS URL
Entity ID
The SP Entity ID
Name ID format
EMAIL
Name ID
Basic Information > Primary email
Click Continue.
4
Configure attribute mapping
Google directory attribute
App attribute
Primary email
email
First name
firstName
Last name
lastName
Click Finish, then set the app’s access to On for everyone (or target specific organizational units).
5
Finish in CloudThinker
On the IdP Config step, enter the Entity ID, SSO URL, and Certificate from Google (or use Import with the metadata URL). Click Create Connection.
1
Create an enterprise application
In the Azure Portal, go to Microsoft Entra ID → Enterprise applications → New application → Create your own application. Name it CloudThinker, select Integrate any other application you don’t find in the gallery, and click Create.
2
Set up single sign-on
Open the application → Single sign-on → SAML, then click Edit on Basic SAML Configuration:
Azure field
CloudThinker value
Identifier (Entity ID)
The SP Entity ID
Reply URL (ACS URL)
The ACS URL
Sign on URL
Same as ACS URL
Save.
3
Configure attributes and claims
In Attributes & Claims, confirm the emailaddress claim maps to user.mail. Optionally add firstName → user.givenname and lastName → user.surname.
4
Copy the federation metadata
In SAML Signing Certificate, copy the App Federation Metadata URL (recommended), or download the Certificate (Base64) with the Login URL and Azure AD Identifier.
5
Assign users and finish in CloudThinker
Assign users under Users and groups. In CloudThinker’s IdP Config step, paste the metadata URL into Import — or enter the Azure AD Identifier as IdP Entity ID, the Login URL as SSO URL, and the Base64 certificate as IdP Certificate. Click Create Connection.
1
Add a custom SAML application
In the AWS Console, go to IAM Identity Center → Applications → Add application → Add custom SAML 2.0 application and name it CloudThinker.
2
Copy the IAM Identity Center metadata
In the IAM Identity Center metadata section, copy the metadata URL (or the issuer URL, sign-in URL, and certificate).
3
Enter the application metadata
IAM Identity Center field
CloudThinker value
Application ACS URL
The ACS URL
Application SAML audience
The SP Entity ID
4
Configure attribute mappings
In Attribute mappings, add:
Application attribute
IAM Identity Center value
Subject
${user:email} — format emailAddress
email
${user:email}
firstName
${user:givenName}
lastName
${user:familyName}
5
Assign users and finish in CloudThinker
Assign users under Assigned users and groups. In CloudThinker, use Import with the metadata URL, or enter the issuer URL as IdP Entity ID, the sign-in URL as SSO URL, and the certificate. Click Create Connection.
1
Create a SAML app integration
In the Okta Admin Console, go to Applications → Applications → Create App Integration → SAML 2.0. Name it CloudThinker.
2
Configure SAML settings
Okta field
CloudThinker value
Single sign-on URL
The ACS URL
Audience URI (SP Entity ID)
The SP Entity ID
Name ID format
EmailAddress
Application username
Email
3
Add attribute statements
Name
Value
email
user.email
firstName
user.firstName
lastName
user.lastName
4
Copy the IdP metadata
After saving, open the app’s Sign On tab → SAML Signing Certificates → Actions → View IdP metadata, and copy the metadata URL — or copy the Identity Provider Single Sign-On URL, Issuer, and X.509 certificate directly.
5
Assign people and finish in CloudThinker
Assign users or groups on the Assignments tab. In CloudThinker, paste the metadata URL into Import, or enter the Issuer as IdP Entity ID, the Single Sign-On URL as SSO URL, and the certificate. Click Create Connection.
1
Add a SAML custom connector
In the OneLogin Admin Portal, go to Applications → Applications → Add App, search for SAML Custom Connector (Advanced), name it CloudThinker, and save.
2
Configure the connector
On the Configuration tab:
OneLogin field
CloudThinker value
Audience (EntityID)
The SP Entity ID
ACS (Consumer) URL
The ACS URL
ACS (Consumer) URL Validator
The exact ACS URL as a regex
Login URL
Same as ACS URL
3
Add parameter mappings
On the Parameters tab, map email → Email, firstName → First Name, lastName → Last Name.
4
Copy the IdP details
On the SSO tab, copy the Issuer URL, SAML 2.0 Endpoint (HTTP), and the X.509 certificate.
5
Assign users and finish in CloudThinker
Add users on the Users tab. In CloudThinker, enter the Issuer URL as IdP Entity ID, the SAML 2.0 Endpoint as SSO URL, and the certificate. Click Create Connection.
Use this for any SAML 2.0-compliant identity provider.Create a SAML app in your provider using CloudThinker’s SP Metadata values — the ACS URL goes in your provider’s “Reply URL”/“ACS URL” field and the SP Entity ID in its “Audience”/“Entity ID” field; some providers can import the SP Metadata URL directly. Map user attributes so the assertion sends the user’s primary email as email (NameID), plus firstName and lastName.Then complete CloudThinker’s IdP Config step:
Field
Where to find it
Display Name
Any label, for example “Okta SSO”
IdP Entity ID
Your provider’s entity identifier (sometimes called “Issuer”)
SSO URL
Your provider’s single sign-on endpoint
IdP Certificate
The X.509 signing certificate, including the BEGIN/END CERTIFICATE lines
SLO URL
Optional single-logout endpoint
Name ID Format
Leave as Email Address unless your provider requires another format
'Invalid ACS URL' error from the identity provider
The ACS URL in your provider must exactly match CloudThinker’s ACS URL — including https:// and no trailing slash.
Names show as email addresses
Your provider isn’t sending firstName and lastName. Add them in the attribute mapping table for your provider above.
Certificate validation error
Paste the full X.509 certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. If your provider rotated its certificate, update IdP Certificate on the connection.
'Audience mismatch' or 'Entity ID mismatch'
The SP Entity ID configured in your provider must exactly match CloudThinker’s SP Entity ID — the comparison is case-sensitive.
