Docs · ENTERPRISE
SSO with SAML and OIDC
Enterprise workspaces can require sign-in through your identity provider. Admins run a setup wizard, test the connection, and optionally disable password login for members.
ENTERPRISESupported protocols and IdPs
- SAML 2.0 and OpenID Connect (OIDC)
- Tested patterns for Okta, Microsoft Entra ID (Azure AD), and Google Workspace
- Per-workspace configuration — each Enterprise tenant brings its own metadata and certificates
Setup workflow
- Provision an Enterprise workspace (pilot or paid plan with SSO entitlement)
- Open Settings → Security → SSO in the admin account
- Follow the wizard: upload IdP metadata or enter issuer, SSO URL, and certificate details
- Map the NameID / email claim to MizuAlign user identity
- Run a test login from the wizard before enabling enforcement
- Toggle “Require SSO” when ready to block password login for workspace members
Security notes
- SSO client secrets and certificates are encrypted with AES-256-GCM before storage
- Consumer Google sign-in (when enabled on non-Enterprise plans) uses MizuAlign’s OAuth flow — separate from Enterprise SAML/OIDC
- Session tokens remain tenant-scoped after SSO — cross-tenant access is denied at the API layer
- SSO configuration changes are recorded in the Enterprise audit log
Troubleshooting
- Clock skew between IdP and MizuAlign can break SAML assertions — sync NTP on your IdP
- Email claim mismatch is the most common login failure — confirm the assertion includes the user’s MizuAlign email
- Keep a break-glass admin password until SSO is verified if your policy allows
- Contact security@mizualign.com for procurement-specific metadata exchange