Authentication and single sign-on
Set up SAML 2.0 or OpenID Connect, verify domains, enforce SSO, require MFA and set the session timeout.
Who can do thisTenant Admin
The SecurityAuthentication page decides how people at Your Company sign in to Juvaro, and the sign-in rules that apply across every app. Here you connect your identity provider with SAML 2.0 or OpenID Connect, prove you own your email domains, turn on enforcement, and set multi-factor authentication and the session timeout.
The left column holds the cards in the order you use them: How people sign in, Password policy, Requirements, MFA visibility, Enforcement with the verified domains, Per-domain enforcement and Findings. The identity provider itself is set up in a large dialog.
How people sign in
The card has two rows. Password is marked Always available: everyone can sign in with an email and password until you enforce single sign-on. Identity provider reads "Not configured - Configure to enable single sign-on" until you save a configuration, and then for example "Configured · SAML · not yet verified".
Connect your identity provider
- Click Configure on the Identity provider row. The dialog Single sign-on configuration opens.
- Under Protocol, pick SAML 2.0 ("Federated SSO via XML assertions.") or OpenID Connect ("Modern OAuth 2.0-based SSO.").
- In Service provider details ("give these to your IdP"), copy the values into the app you create in your identity provider. Each has a Copy button: ACS URL (Assertion Consumer Service), SP Entity ID, SP Metadata URL and Redirect URI.
- Under Identity provider details, fill in the values from your identity provider (see the table below).
- Click Test connection. Before a protocol is set up, the dialog says "Configure a protocol, then test the connection." After a test it shows Last verified: with the time.
- Click Save configuration. The toast says "SSO configuration saved."
| Protocol | Fields under Identity provider details |
|---|---|
| SAML 2.0 | IdP metadata URL, Entity ID, Sign-in URL (SSO endpoint), Signing certificate (x.509) |
| OpenID Connect | Issuer URL, Client ID, Client secret |
Secrets and certificates are never shown again once stored. When you edit later, leave Client secret or the certificate blank to keep the stored value.
Run Test connection until it passes before you go further. Enforcement refuses to switch on without a passing test.
Verify your domains
Under Enforcement, the row Verified domains lets you prove you control a domain with a DNS TXT record.
- Type the domain, for example your-company.example (placeholder "example.com"), and click Add domain. It is listed with the badge pending.
- Publish the TXT record shown under the domain at your DNS provider. Copy the Name and Value exactly.
- Click Verify. On success the badge changes to verified and the toast says "Domain verified."
If the record cannot be found yet, you see "TXT record not found yet - DNS can take a few minutes to propagate." Wait and click Verify again. Remove takes a domain off the list. A typing error is refused with "Not a valid domain".
Choose the domains to enforce
The Per-domain enforcement card has a switch for each domain. Only verified domains can be switched on. You can choose the domains first and turn on enforcement afterwards: while enforcement is off, the card says "Enforcement is off, so these selections have no effect yet. Switch on enforcement above to apply them." Once it is on: "Users at the selected domains are sent to your identity provider and cannot sign in with a password."
Enforce single sign-on
Switch on Enforce single sign-on ("Require all users to sign in through the configured IdP.") in the Enforcement card. Three things must be in place first. If one is missing, the switch is refused with the title "Cannot enforce SSO yet" and one of these messages, in English:
| Missing | Message |
|---|---|
| A verified domain | "Enforcing SSO requires a verified domain. Add a domain and publish its TXT record to verify it, then select it for enforcement." |
| A domain selected for enforcement | "No domain is selected for enforcement, so turning this on would enforce nothing. Select at least one verified domain below." |
| A passing test | "Enforcing SSO requires a passing IdP test-connection. Run the test on your identity-provider configuration and fix any error it reports first." |
Switching on enforcement for a domain that is not verified is refused with "Domain is not verified". If enforcement is on but no domain is verified, the Overview lists "SSO is enforced but no domain is verified" under Needs attention.
Require MFA and set the session timeout
The Requirements card has two settings. Both carry the note "Applies once SSO is active."
- Require multi-factor authentication: applies MFA on top of SSO for every sign-in. Off by default.
- Session timeout: signs people out after a period of inactivity. Choose 30 minutes, 1 hour, 8 hours or 24 hours. The default is 8 hours.
Both save as soon as you change them.
Password policy
The Password policy section is shown greyed out, with switches for minimum length, password reuse and expiry that cannot be used. As the card explains, password rules are set by Juvaro for the whole platform, so they cannot be changed per workspace.
MFA visibility and Findings
MFA visibility counts the members who have set up a second factor. It shows "Every member has a second factor." or, for example, "3 of 12 members have no second factor". If the identity provider cannot be reached, it says "Couldn't check with the identity provider just now." instead of showing a number. Members set up their own second factor on their Account & security page.
Findings repeats the Security posture checks from the Overview, each with a Review button. The check names and texts are in English. See Workspace administration at a glance.
Directory sync with SCIM and write-back to your directory are on a separate page. See Identity sources.