Skip to main content

​
Enterprise SSO

Connect your identity provider so administrators sign in to the console with your organization’s credentials instead of a Cobalt password. Cobalt brokers the connection — you provide your IdP’s metadata, paste two values back into your IdP, and you’re done.
SAML 2.0 is supported today (Okta, Microsoft Entra ID / Azure AD, Google Workspace, OneLogin, Ping, and any SAML IdP). OIDC connections for administrator sign-in are coming; the console shows OIDC as “coming soon.” (This is separate from end-user federated identity, where verifying an OIDC/JWT token from your IdP is supported — see End-user identity.) SSO is available on plans that include it — talk to us if you don’t see it.
SSO governs administrator sign-in. It does not, by itself, sign in end users — for that, see End-user identity.

​
Connect a SAML provider

1

Open Settings → Single sign-on

Requires the Admin or Owner role. Choose SAML and your provider.
2

Enter your IdP metadata URL

Paste the metadata URL (or endpoint) from your IdP’s SAML app. Cobalt reads your signing certificate and endpoints from it — you never upload a cert by hand.
3

Copy the service-provider values into your IdP

Cobalt shows two values to paste into your IdP’s SAML app:
  • ACS URL (Assertion Consumer Service / reply URL)
  • Entity ID (audience / SP identifier)
4

Map attributes

Ensure your IdP sends email, and — if you want role mapping — a groups attribute (see below). First name / last name are optional.
5

Activate and test

Activate the connection, then sign in from an incognito window with a test account to confirm the round-trip. The connection shows Active once it’s verified.
Provider-specific cheat sheet for the values you’ll paste into the IdP:

​
Map groups to roles

Instead of assigning roles by hand, let your directory drive them.
1

Send a groups attribute from your IdP

Configure your SAML app to release the user’s group memberships as a groups attribute.
2

Add mappings in Settings → Single sign-on

Add rows mapping an IdP group name to one or more Cobalt roles — e.g. cobalt-admins → Admin, finance → Billing.
How it behaves:
  • New assignments and changes apply at the user’s next SSO sign-in (that’s when your IdP sends fresh group claims).
  • Removals and de-provisioning apply automatically — if someone is removed from a mapped group or off-boarded, their elevated access is revoked without waiting for them to sign in.
  • Unmapped users default to Member (least privilege).
  • Owner is never assignable by mapping, and Cobalt never strips the workspace’s last Admin/Owner.
No mappings? Then SSO only handles sign-in, and you assign roles manually on the Team page. Group mapping is optional.

​
Keep or disable password sign-in

Once SSO is active you can record whether email/password (and social) sign-in should remain available for your team. Today this setting is advisory — it documents your policy and drives console messaging, but existing password sign-in isn’t blocked yet. Full enforcement is coming; until then, govern access by removing members who shouldn’t retain password credentials.

​
Remove a connection

Deleting the SAML connection returns the workspace to email/password sign-in. Any end-user widget mode that depended on SSO is disabled until reconfigured.