Skip to content

Single sign-on

Single sign-on (SSO) lets a tenant's users sign in to Myra AI Workspace through the organisation's own identity provider instead of an email code. Myra supports two protocols:

  • OpenID Connect (OIDC) — a token-based protocol used by Microsoft Entra ID, Okta, Auth0, Keycloak, Google Workspace, and Active Directory Federation Services (ADFS).
  • SAML 2.0 — an assertion-based protocol used by the same identity providers and by many enterprise directories.

A tenant may enable either protocol, or both. When a domain is configured for both, Myra uses OIDC.

Single sign-on scope

Single sign-on authenticates existing accounts only. It does not create users. Provision the users first — manually, or through SCIM provisioning — then enable single sign-on.

Each identity provider is the identity authority for its own tenant only. A user resolved to a different tenant than the one initiating the sign-in is rejected. A first-time sign-in links to an existing account by verified email or UPN, and only within the tenant's allowed-domain allowlist. An unknown identity is rejected — no account is created.

The verified-domain allowlist

Every single sign-on configuration carries an Allowed email domains list. This list serves two purposes:

  • It is the domain-to-tenant mapping the sign-in page uses to offer the Continue with SSO button.
  • It is the security boundary: the identity provider may only sign in users whose email or UPN is in one of these domains.

Enabling single sign-on

Configure single sign-on per tenant in the tenant edit dialog, under the Single sign-on (SSO) section (see Tenants). Creating, updating, or deleting a configuration requires the SSO_MANAGE permission, held by the tenant admin and admin roles and by any custom role granted it.

Provider guides

For the runtime endpoints, the identity-provider requirements, and the fail-closed token verification, see Admin API authentication. For the end-user sign-in flow, see Signing in.