> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Integration Overview

> Configure SAML 2.0, OAuth 2.0, and LDAP single sign-on for Prizm.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "SSO Integration Overview",
            "description": "Configure SAML 2.0, OAuth 2.0, and LDAP single sign-on for Prizm.",
            "url": "https://docs.dqlabs.ai/security/sso",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## Overview

Prizm offers comprehensive Single Sign-On (SSO) support, integrating with major identity providers to enable seamless authentication experiences while maintaining enterprise security standards. SSO eliminates password fatigue for users and centralizes identity governance for administrators.

## Supported Protocols

| Protocol             | Supported Providers                     | Use Case                             |
| -------------------- | --------------------------------------- | ------------------------------------ |
| **SAML 2.0**         | Okta, Azure AD, OneLogin, PingFederate  | Enterprise SSO, federated identity   |
| **OAuth 2.0 / OIDC** | Google Workspace, Okta, Azure AD, Auth0 | Modern web/mobile app authentication |
| **LDAP**             | Active Directory, OpenLDAP, FreeIPA     | On-premise directory integration     |

## SAML 2.0 Integration

### Service Provider Metadata

Use the following Prizm (Service Provider) values when configuring your identity provider:

| Field               | Value                                                    |
| ------------------- | -------------------------------------------------------- |
| Entity ID           | `https://app.prizm.io/saml/metadata`                     |
| ACS URL             | `https://app.prizm.io/saml/acs`                          |
| Sign in URL         | `https://app.prizm.io/api/v1/auth/sso/login`             |
| SLO URL             | `https://app.prizm.io/saml/slo`                          |
| Name ID Format      | `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` |
| Signing Certificate | Available in **Admin Settings → SSO Configuration**      |

### Required Attribute Assertions

| Attribute     | SAML Claim                                                             | Required    |
| ------------- | ---------------------------------------------------------------------- | ----------- |
| Email Address | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`   | ✅ Yes       |
| First Name    | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`      | Optional    |
| Last Name     | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`        | Optional    |
| User ID       | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier` | Optional    |
| Groups        | `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups`       | Recommended |

### Provider Setup

* [OKTA](/security/sso/okta)
* [Azure Active Directory / Entra ID](/security/sso/azure)
* [Ping Identity](/security/sso/ping-identity)
* [IBM Verify](/security/sso/ibm-verify)

## OAuth 2.0 / OpenID Connect

### Configuration Steps

<Steps>
  <Step title="Register Prizm">
    Register Prizm as an OAuth 2.0 client application with your identity provider.
  </Step>

  <Step title="Note credentials">
    Note the **Client ID** and **Client Secret** provided by the IdP.
  </Step>

  <Step title="Set redirect URI">
    Configure the redirect URI: `https://app.prizm.io/auth/callback`
  </Step>

  <Step title="Configure in Prizm">
    Enter the Client ID, Client Secret, and discovery endpoint URL in **Admin Settings → SSO**.
  </Step>

  <Step title="Configure scopes">
    Confirm the required scopes are enabled: `openid`, `profile`, `email`, `groups`.
  </Step>

  <Step title="Test">
    Test the integration using the built-in **Test SSO Connection** button.
  </Step>
</Steps>

### Required Scopes

| Scope     | Purpose                                      |
| --------- | -------------------------------------------- |
| `openid`  | Required for OpenID Connect authentication   |
| `profile` | Access to user profile information           |
| `email`   | Access to user email address                 |
| `groups`  | Access to group memberships for RBAC mapping |

## Group Synchronization

Prizm automatically synchronizes group memberships from the identity provider, enabling automatic RBAC assignment based on IdP groups. This allows organizations to manage Prizm access through their existing directory management workflows.

* IdP groups are synchronized at login and on configurable intervals
* Group membership changes in the IdP take effect on the user's next login
* Multiple IdP groups can be mapped to a single Prizm role
* Role precedence rules apply when a user belongs to multiple mapped groups

Configure mappings in **Admin Settings → Group Mapping**.

## Session Management

| Setting                 | Default    | Range                     |
| ----------------------- | ---------- | ------------------------- |
| Session timeout         | 8 hours    | 15 minutes – 24 hours     |
| Idle timeout            | 30 minutes | 5 minutes – 4 hours       |
| Concurrent sessions     | Allow      | Allow / Deny / Prompt     |
| Remember Me             | Disabled   | Up to 30 days             |
| Force re-authentication | Off        | Configurable per resource |

## Security Considerations

<Note>
  All SAML assertions must be signed by the IdP. Prizm validates assertion signatures using the configured IdP certificate. Certificate rotation is supported without service interruption.
</Note>

* Failed authentication attempts are logged in the audit trail
* JIT (Just-in-Time) user provisioning creates accounts on first SSO login
* Deprovisioned IdP accounts lose Prizm access on next session validation

## Troubleshooting

| Issue                       | Resolution                                                               |
| --------------------------- | ------------------------------------------------------------------------ |
| Assertion validation failed | Verify the IdP signing certificate matches the one configured in Prizm   |
| User not found after login  | Confirm the email attribute is being sent in the assertion               |
| Groups not synchronized     | Verify the groups claim is configured and the attribute name matches     |
| Redirect loop               | Check ACS URL and Entity ID match exactly (case-sensitive)               |
| Certificate expired         | Upload the new IdP certificate in **Admin Settings → SSO** before expiry |