AAuthpermit
Start free

Single sign-on

Your identity provider signs your people into Authpermit. Here Authpermit is the relying party, and the assurance the assertion carries is recorded rather than assumed.

Setting it up

  1. In Settings → Enterprise, add a connection and choose OpenID Connect or SAML 2.0.
  2. Give the email domains it covers. People with those domains are sent to your provider.
  3. Enter the issuer, client id and client secret. The secret is encrypted under your organization's credential key and never shown again.
  4. Map your groups to Authpermit roles. A group you do not map grants nothing, so renaming a group in your directory cannot silently widen access.
  5. Set the assurance level your provider gives. Level 3 or above is treated as a second factor.
  6. Activate. A connection that is missing what it needs cannot be activated.

Just-in-time provisioning

By default, someone signing in for the first time from a covered domain gets an account and a membership. Turn it off and only people who already exist can sign in.

OpenID Connect

Authpermit reads your provider's discovery document ({issuer}/.well-known/openid-configuration, or the URL you give) and refuses one that names another issuer. Each sign-in carries a fresh state, nonce and PKCE (S256) challenge; all three are kept server-side and work once, for ten minutes, in the browser that started. The ID token must be signed with an asymmetric key from your provider's JWKS (RS/PS/ES 256–512 or EdDSA; none and HMAC are refused), name your issuer, your client id as audience, carry the nonce, be unexpired, and not say email_verified: false. The JWKS is cached for an hour; a token signed with a new key id fetches it again once, so key rotation needs no action. Redirect URI: /auth/sso/callback.

SAML 2.0

Give your provider the service-provider metadata at /auth/sso/{connection id}/metadata: the entity id is that URL, the assertion consumer service is /auth/sso/saml/acs (HTTP-POST). Paste your provider's signing certificate into the connection (two certificates side by side during a rotation). Authpermit sends a signed-request-free AuthnRequest and accepts only a response that:

  • is signed with that certificate — the assertion itself or the whole response (RSA or ECDSA with SHA-256 or stronger, exclusive canonicalization). An unsigned or wrongly signed assertion is refused; SHA-1 is refused;
  • answers the request this browser sent (InResponseTo); unsolicited, IdP-initiated responses are refused;
  • names this service provider as audience and this ACS URL as recipient, within its validity window;
  • contains exactly one plain assertion (encrypted assertions are not supported yet) and no DOCTYPE.

The email comes from the NameID (email format) or an email/mail attribute; groups from groups/memberOf.

Single sign-on is on the Enterprise and Sovereign plans.