Get early access
In this section (15)

Set up SAML single sign-on for agents

Let agents sign in with Okta, Microsoft Entra ID or another SAML identity provider.

2 min read Beta

Available on Enterprise. Compare plans

This feature is still being built. Some steps or screens may change.

With SAML single sign-on, agents and admins sign in through your identity provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace. ChaosDesk supports SAML 2.0, signed requests and responses, encrypted assertions and single logout.

The admin screen for SAML is being built. This article describes the connection as it works today.

What you set up

At your IdP, create a SAML app for ChaosDesk using the service provider metadata of your workspace (entity ID, assertion consumer URL and certificate). Then give ChaosDesk:

  • the IdP’s entity ID, sign-in URL and, optionally, single logout URL;
  • the IdP’s signing certificate (you can import all of these from the IdP’s metadata);
  • the NameID format and which attributes carry the email and name.

Options

  • Just-in-time provisioning: people who are not agents yet become agents on their first sign-in. When off, only existing agents can sign in.
  • Required group: only members of this IdP group may sign in.
  • Role mappings: an IdP group gives the Admin role, the Agent role or a custom role. Otherwise the default role applies.
  • Group mappings: IdP groups decide membership of ChaosDesk groups. Only groups you map are managed; other memberships are left alone.
  • Sync on sign-in: apply role and group mappings again at every sign-in.
  • IdP-initiated sign-in: allow sign-in from the IdP’s app tile.

Role and group changes made this way appear in the admin audit log.

SSO only

When you enforce SAML, agents must sign in through the IdP and password sign-in refuses them. Break-glass accounts chosen by an admin (at least the admin who switched enforcement on) keep their password, so a broken IdP never locks you out.

Security

ChaosDesk checks signatures, audience, destination, timestamps and replays on every response. It does not ask for a specific authentication method, so IdPs with MFA or passwordless sign-in work. Require MFA at your IdP.

Was this article helpful?