Skip to main content

Single sign-on (SSO)

Single sign-on lets your team sign in to Enigma Console using your organization's identity provider (IdP). Enigma supports any SAML 2.0 compliant provider, including Okta, Azure AD, Google Workspace, and OneLogin.

Prerequisites​

Before you begin, verify that you have:

  • Admin or Owner role in your Enigma organization
  • Administrative access to your identity provider
  • Ability to create SAML applications in your IdP

How SSO works​

Enigma uses SAML 2.0 with a service provider (SP) initiated flow:

  1. A user visits https://console.enigma.com/login and clicks Log in with SSO
  2. The user enters their email address
  3. Enigma redirects them to your identity provider
  4. The user authenticates with your IdP
  5. Your IdP sends a SAML assertion back to Enigma
  6. Enigma validates the assertion and signs the user in

Step 1: Create a SAML application in your IdP​

Start by creating a new SAML application in your identity provider. The exact steps vary by provider, but you typically need to:

  1. Navigate to your IdP's application catalog
  2. Create a new SAML 2.0 application
  3. Configure the application with placeholder values (you'll update these after configuring Enigma)

Keep your IdP configuration open. You'll return to it after completing the Enigma configuration.

Step 2: Configure Enigma​

  1. Sign in to Enigma Console with your username and password
  2. Go to Team Members
  3. Click Configure Identity Provider

Provide your IdP's SAML metadata​

You can provide your IdP's SAML metadata using either method:

MethodDescription
Metadata URLPaste your IdP's metadata endpoint URL. Enigma fetches the metadata automatically and keeps it synchronized.
Metadata fileUpload the XML metadata document from your IdP. The file must use UTF-8 encoding.

Choose one method. If you enter a URL, the file upload is disabled, and vice versa.

SSO configuration form

Map SAML attributes​

Configure how your IdP's attributes map to Enigma user properties. Enter the exact attribute names your IdP sends in the SAML assertion.

Enigma attributeDescriptionRequiredCommon IdP attribute names
emailUser's email addressYesuser.email, email, emailAddress
given_nameUser's first nameYesuser.firstName, givenName, firstName
family_nameUser's last nameYesuser.lastName, surname, familyName
nameUser's full display nameYesuser.displayName, name, displayName
Attribute names are case-sensitive

The attribute names must match exactly what your IdP sends. For example, if your IdP sends Email but you configure email, authentication fails.

Click Save Configuration to save your settings.

Copy Enigma's sign-on settings​

After you save your configuration, Enigma displays its service provider settings. Copy these values for the next step:

SettingDescription
Assertion Consumer URLThe endpoint where your IdP sends SAML responses
Service Provider Entity IDEnigma's unique identifier as a service provider

Step 3: Update your IdP configuration​

Return to your identity provider and update the SAML application:

  1. Set the Assertion Consumer Service (ACS) URL to the value you copied from Enigma
  2. Set the SP Entity ID (or Audience URI) to Enigma's Service Provider Entity ID
  3. Configure attribute mappings to send the required attributes (email, given_name, family_name, name)
  4. Assign users or groups to the application

Step 4: Test the connection​

  1. Open a private or incognito browser window
  2. Go to https://console.enigma.com/login
  3. Click Log in with SSO
  4. Enter your email address
  5. Verify that you're redirected to your IdP and can authenticate
note

Configuration changes may take a few minutes to propagate. If the SSO flow doesn't work immediately, wait 2-3 minutes and try again.

IdP-initiated sign-in not supported

Users must always start from the Enigma sign-in page. Clicking the Enigma application tile directly from your IdP dashboard (such as an Okta chiclet) doesn't work. Direct your users to https://console.enigma.com/login and have them click Log in with SSO.

Troubleshooting​

Invalid SAML response error​

This error typically indicates an attribute mapping problem:

  • Verify that attribute names match exactly, including capitalization
  • Check that your IdP is sending all four required attributes
  • Confirm that your IdP's metadata URL is accessible from the internet

Users don't see the SSO option​

  • SSO sign-in is available at https://console.enigma.com/login. Users must click Log in with SSO and enter their email
  • Configuration changes may take a few minutes to propagate. Wait 2-3 minutes and try again

Duplicate provider error​

This error appears if your IdP has already been configured for another Enigma organization. Each IdP can only be linked to one Enigma organization. Contact Enigma support if you need to transfer an IdP configuration.

Last updated on