Single Sign-On (SSO)
Single Sign-On lets your users access AlchemOS Positive using your existing corporate identity provider (IdP) — such as Okta, Azure AD / Entra ID, or Google Workspace — without a separate password.
Supported protocols
| Protocol | Status |
|---|---|
| OIDC (OpenID Connect) | Available — supports Okta, Azure AD / Entra ID, Google Workspace, Auth0 and any OIDC-compliant IdP |
| SAML 2.0 | On the roadmap — planned for the Enterprise tier. Contact us to be notified when available or to discuss early access. |
Requirements
- Enterprise plan (SSO is an Enterprise-only feature)
- Admin access to your IdP
- Admin access in AlchemOS Positive
Configuring OIDC
Step 1 — Create an OIDC application in your IdP
In your IdP's admin console, create a new web application with OpenID Connect:
- Set the redirect URI to:
https://id.alchemos.io/oidc/callback/{tenant-id} - Note the Client ID and Client Secret
- Ensure the application grants the scopes:
openid email profile
Provider-specific guides:
| IdP | Application type |
|---|---|
| Azure AD / Entra ID | App Registration → Web → Redirect URI |
| Okta | Applications → Create App Integration → OIDC → Web Application |
| Google Workspace | APIs & Services → Credentials → OAuth 2.0 Client ID → Web application |
| Auth0 | Applications → Regular Web Application |
Step 2 — Enter OIDC settings in AlchemOS Positive
In Settings → Security → Single Sign-On → OIDC:
| Field | Value |
|---|---|
| Discovery URL | Your IdP's .well-known/openid-configuration endpoint |
| Client ID | From your IdP application |
| Client Secret | From your IdP application |
| Scopes | openid email profile (minimum) |
Click Save and Test. A test login window will open to verify the configuration before you activate SSO.
Role mapping
Map IdP groups to AlchemOS Positive roles so users are granted the correct permissions automatically on first login:
- Go to Settings → Security → SSO → Role Mapping → Add Rule
- Enter the Group claim value exactly as it appears in the OIDC token (
groupsclaim) - Select the AlchemOS role to assign
If a user belongs to multiple groups, the highest-privilege mapped role applies.
Just-in-time provisioning
When SSO is enabled, new users are provisioned automatically on first login (JIT provisioning):
- A new AlchemOS Positive account is created for the user
- The assigned role comes from the group-to-role mapping rules
- No separate invitation is required
Disable JIT provisioning if you prefer to require explicit invitations before SSO users can access the platform.
SSO enforcement
To require all users to authenticate via SSO (disabling email/password login):
- Go to Settings → Security → SSO → Enforce SSO
- Confirm you have tested SSO successfully first — enforcing SSO without a working configuration will lock out users
Admin bypass: Super Admins can always use email/password login at https://id.alchemos.io/admin-login for emergency access.
SCIM provisioning
For automated user lifecycle management (create, update, deprovision users from your IdP):
- AlchemOS Positive provides a SCIM 2.0 endpoint at
https://id.alchemos.io/scim/v2/{tenant-id} - Requires a SCIM API token (generated in Settings → Security → SCIM)
- Supports user create, update (name, email, role), deactivate and delete