AurykleWhat this setup changes
Federated SSO lets your team sign in to its Aurykle workspace through your company identity provider. It does not give Aurykle access to administer your identity provider. Supported enterprise connections can also use SCIM to provision users and groups.
Before you start
Have the following people and information available:
- An Aurykle workspace owner who can open Workspace settings.
- An administrator for your Okta, Microsoft Entra ID, Google Workspace, SAML, or OIDC identity provider.
- Your organisation’s sign-in domain and a way to verify it.
- A test user whose primary email address can be released to Aurykle.
Plan a safe rollout. Keep an existing owner login available until SSO has been tested successfully. Do not use your only administrator account as the first test user.
Set up federated SSO
Choose how new users are admitted
In Workspace settings → Federated SSO, choose Invitation only, Just-in-time viewer, or Provisioned access. Invitation only is the safer default for a controlled rollout.
Open the secure setup assistant
Select Configure SSO. Aurykle opens an Auth0 self-service assistant scoped to this workspace. The setup link expires after one hour.
Treat the link as sensitive. If the identity administrator is completing setup separately, share it only through an approved private channel and generate a new link if it expires.
Configure your identity provider
Choose the provider in the assistant and follow its instructions. Auth0 supplies the callback, redirect, ACS, issuer, or audience values needed by the selected protocol.
Ensure the resulting profile includes the user’s primary email address. Never send passwords, signing keys, client secrets, or setup links to Aurykle support.
For Provisioned access, also complete the provisioning section and assign a restricted test group before synchronising the wider directory.
Verify your company domain
Complete the domain-verification step in the assistant. Domain discovery does not become active until verification succeeds.
Synchronise provisioned access
If you selected Provisioned access, return to Workspace settings and select Sync directory now. Map the restricted test group to an Aurykle role. A user in more than one mapped group receives the highest role.
Test an organisation sign-in
When the connection appears, select Test SSO sign-in and authenticate with the test user. Confirm that the correct workspace and expected role are shown.
Roll out access
Invite the required users, enable Just-in-time viewer access, or assign the approved directory groups for Provisioned access. After provider-side provisioning changes, ask a workspace owner to select Sync directory now. Then share the normal Aurykle sign-in page. Workspace owners can reopen the provider configuration later with a fresh Manage link.
Provider guidance
The Auth0 assistant adapts the setup fields to the selected provider. The available choices can vary with the Aurykle environment and Auth0 subscription.
Okta Workforce
Use the guided Okta connection when available. Complete the app integration in the Okta Admin Console and assign only test users until validation is complete.
Microsoft Entra ID
An Entra administrator should complete tenant consent and app assignment. Start with a restricted test group before wider access.
Google Workspace
Use a Workspace administrator account and confirm that the test user’s primary email belongs to the verified company domain.
Generic SAML or OIDC
Follow the values generated by the assistant exactly. For SAML, confirm the email attribute mapping; for OIDC, confirm the email scope and claim.
How user access works
- Invitation only
- The user needs a pending Aurykle invitation that exactly matches the email verified by the identity provider. The role comes from that invitation.
- Just-in-time viewer
- A new user authenticated through the workspace organisation joins as a viewer. An Aurykle owner must explicitly grant a higher role.
- Provisioned access
- Signing in does not create Aurykle access. The user must be active in the connected directory and included by an approved group-to- role mapping. Directory-managed roles and suspensions must be changed in the identity provider.
- Existing users
- SSO access is confined to the organisation and workspace used for that sign-in. It does not create a separate personal workspace.
Troubleshooting
The setup link expired
Ask the Aurykle workspace owner to select Configure SSO or Manage again to generate a fresh link.
Workspace settings still says “Setup pending”
The workspace is ready, but the enterprise connection has not been completed or enabled. Reopen the setup assistant and finish the provider and domain-verification steps.
The user signed in but has no workspace
For Invitation only, confirm the pending invitation matches the user’s verified identity-provider email exactly. For Provisioned access, confirm the user is active and belongs to an approved directory group. Ask a workspace owner to synchronize after the latest directory change. Also confirm the user started an organisation SSO sign-in rather than another login method.
Domain verification is pending
Confirm the verification record or method with your identity or DNS administrator, then reopen Manage after verification completes.
Still need help?
Contact Aurykle support with the workspace name, provider type, safe error code, and approximate time of failure. Do not include credentials, tokens, or the secure setup URL.