Skip to main content

​
Overview

Prizm offers comprehensive Single Sign-On (SSO) support, integrating with major identity providers to enable seamless authentication experiences while maintaining enterprise security standards. SSO eliminates password fatigue for users and centralizes identity governance for administrators.

​
Supported Protocols

​
SAML 2.0 Integration

​
Service Provider Metadata

Use the following Prizm (Service Provider) values when configuring your identity provider:

​
Required Attribute Assertions

​
Provider Setup

​
OAuth 2.0 / OpenID Connect

​
Configuration Steps

1

Register Prizm

Register Prizm as an OAuth 2.0 client application with your identity provider.
2

Note credentials

Note the Client ID and Client Secret provided by the IdP.
3

Set redirect URI

Configure the redirect URI: https://app.prizm.io/auth/callback
4

Configure in Prizm

Enter the Client ID, Client Secret, and discovery endpoint URL in Admin Settings → SSO.
5

Configure scopes

Confirm the required scopes are enabled: openid, profile, email, groups.
6

Test

Test the integration using the built-in Test SSO Connection button.

​
Required Scopes

​
Group Synchronization

Prizm automatically synchronizes group memberships from the identity provider, enabling automatic RBAC assignment based on IdP groups. This allows organizations to manage Prizm access through their existing directory management workflows.
  • IdP groups are synchronized at login and on configurable intervals
  • Group membership changes in the IdP take effect on the user’s next login
  • Multiple IdP groups can be mapped to a single Prizm role
  • Role precedence rules apply when a user belongs to multiple mapped groups
Configure mappings in Admin Settings → Group Mapping.

​
Session Management

​
Security Considerations

All SAML assertions must be signed by the IdP. Prizm validates assertion signatures using the configured IdP certificate. Certificate rotation is supported without service interruption.
  • Failed authentication attempts are logged in the audit trail
  • JIT (Just-in-Time) user provisioning creates accounts on first SSO login
  • Deprovisioned IdP accounts lose Prizm access on next session validation

​
Troubleshooting