Configure Single Sign-On (SSO)

SSO lets users sign in to Launchpad through their organization’s identity provider instead of separate KODE Labs credentials. Launchpad supports OIDC and SAML, with pre-built integrations for several identity providers. You configure sign-in methods from Sign In Methods in the sidebar.

Sign In Methods page showing Email and Password and Azure AD set as the default method, with an Add Sign in Method button — The Sign In Methods page shows all configured methods, including Email & Password and any SSO integrations

Benefits of Single Sign-On

SSO simplifies the sign-in experience by eliminating the need to manage separate credentials for each platform. Users authenticate once through their organization’s identity provider and gain access to Launchpad and other connected applications without repeated logins. This reduces password-related support requests and frees IT teams to focus on higher-priority work.

Centralized authentication through your existing identity provider
Reduced credential fatigue, as users rely on one set of credentials across platforms
Stronger security posture by enforcing your organization’s authentication policies
Simplified user management, with user provisioning and de-provisioning handled through your IdP
Fewer password-related support tickets for IT teams

Launchpad supports SSO through the following authentication protocols.

OpenID Connect (OIDC) — a modern authentication protocol commonly used for web and mobile applications.
Security Assertion Markup Language (SAML) — an XML-based protocol widely adopted for enterprise SSO across web applications.

KODE Labs has integrated with the following identity providers:

CyberArk
Azure Active Directory (Azure AD)
Okta
Auth0
JumpCloud

You can also configure a custom OIDC or SAML integration with any IdP that supports these protocols.

Configuration

Setting up SSO requires configuring a sign-in method in Launchpad and connecting the corresponding application in your identity provider. You complete both from a single form in Launchpad. Click + Add Sign in Method to choose a protocol or pre-built template.

Choose Sign in Method dialog showing OIDC and SAML protocol options and pre-built templates for Auth0, Azure AD, Okta, CyberArk, and JumpCloud — Choose between OIDC or SAML protocols, or select a pre-built template for Auth0, Azure AD, Okta, CyberArk, or JumpCloud

Before you begin, verify that you have an admin role in your Launchpad workspace and access to your identity provider’s configuration settings.

OIDC
SAML

Open sign-in methods

In the Launchpad sidebar, click Sign In Methods, then click + Add Sign in Method. Select one of the pre-configured identity providers that uses OIDC, or choose a custom OIDC configuration if your provider is not listed.

Copy callback URL

Launchpad generates an Authentication Callback URL at the top of the form. Copy this value — you need to enter it in your IdP as the Redirect URL or Callback URL.

Field

The callback endpoint your IdP redirects users to after authentication. This value is auto-generated and read-only.

Name sign-in method

In the Sign In Method Name field, enter a unique name for this method. You can optionally upload an IdP picture.

The sign-in method name cannot be changed after you save it.

Set up app in IdP

Log in to your identity provider and create a new application for KODE Labs. Provide the Authentication Callback URL you copied from Launchpad. After configuring the application, your IdP provides the values needed for the next step.

Enter IdP details

Back in the Launchpad form, enter the following values from your IdP:

Field

The OpenID Connect discovery endpoint provided by your IdP (typically ending in /.well-known/openid-configuration).

Field

The unique identifier your IdP assigned to the KODE Labs application.

Field

The secret key your IdP generated for this application.

Configure email claim

Under Claim configuration for email, verify that the Email field is set to the claim your IdP uses for email addresses (defaults to email).

Save

Optionally check Set as default Sign In Method if you want this to be the primary sign-in option for your organization. Click Save.

Add Sign-In Method form for SAML showing Assertion Consumer Service URL, SP Certificate download, sign-in method name field, SP Entity ID, SAML Subject NameID Format, Signature Algorithm, Protocol Binding, and Sign Request toggle — The SAML configuration form shows generated values, sign-in method name, and pre-configured protocol fields

Open sign-in methods

In the Launchpad sidebar, click Sign In Methods, then click + Add Sign in Method. Select one of the pre-configured identity providers that uses SAML, or choose a custom SAML configuration if your provider is not listed.

Copy generated values

Launchpad generates several values at the top of the form. Copy or download these — you need them when configuring the application in your IdP.

Field

The endpoint where your IdP sends SAML responses after authentication. Copy this into your IdP’s ACS URL field.

Field

The service provider certificate (x509Certificate.pem). Click Download to save it.

Name sign-in method

In the Sign In Method Name field, enter a unique name for this method. You can optionally upload an IdP picture.

The sign-in method name cannot be changed after you save it.

Review pre-configured fields

The following fields are pre-configured in Launchpad and must match the corresponding values in your IdP:

Field

The unique identifier for Launchpad as a service provider.

Field

The format used to identify users. Pre-set to EmailAddress.

Field

The algorithm used to sign SAML assertions. Pre-set to RSA-SHA256.

Field

The transport method for SAML messages. Pre-set to HTTP-POST.

Toggle

When enabled, Launchpad signs outgoing SAML requests. Disabled by default.

Set up app in IdP

Log in to your identity provider and create a new application for KODE Labs. Provide the Assertion Consumer Service URL, SP Entity ID, NameID Format, Signature Algorithm, and Protocol Binding values from the Launchpad form. Configure attribute mapping in your IdP for firstName, lastName, and optionally roles to synchronize role assignments.

Enter IdP details

Back in the Launchpad form, you can either upload a metadata XML file to autofill the fields below, or enter them manually:

Field

Upload your IdP’s metadata XML file to autofill the IdP URL, IdP Entity ID, and Certificate fields.

Field

The SSO endpoint provided by your IdP for SAML authentication.

Field

The unique identifier for your identity provider.

Field

The public certificate your IdP uses to sign SAML assertions. Upload a .pem or .der file.

Configure email claim

Under Claim configuration for email, enter the attribute your IdP uses for email addresses in the Email field.

Save

Optionally check Set as default Sign In Method if you want this to be the primary sign-in option for your organization. Click Save.

Role mapping

With SSO enabled, you can pass user roles from your identity provider to KODE OS automatically. This means user permissions are managed in your IdP rather than individually in Launchpad. Role mapping is optional — you can always set user permissions directly in KODE OS regardless of how users authenticate.

Role mapping requires attribute configuration in both your IdP and Launchpad. Before you configure role mappings, add the roles attribute in the Attribute Mappings section of your IdP and return the information in KODE Labs.

To configure role mapping, open the sign-in method in Launchpad and configure the following options:

Allows automatic user creation on first login. When enabled, configure the First Name attribute, Last Name attribute, and Roles attribute that your IdP returns.

Toggle

Sets a fallback role for users who do not have a role mapped in this sign-in method. You can add additional roles after you save the sign-in method.

When enabled, existing roles assigned to users in Launchpad are overridden by the roles assigned to their IdP groups on each login.

Toggle

When enabled, allows access to the site map. You can add additional site mappings after you save the sign-in method.

After you enable IdP role mapping, role management for users of that IdP is handled from your IdP instead of from Launchpad. You can manage your role mappings by adding the ability to create, update, and assign users to buildings on sign-in.

Attribute mapping

Under Attribute Mapping in your IdP, add the following attributes. If you want to map IdP groups or roles to KODE OS roles, add a roles attribute and return your IdP users’ roles or groups to Launchpad.

SAML IdP: firstName attribute, lastName attribute, roles attribute
OIDC IdP: firstName claim, lastName claim, roles claim

Edit SSO configuration

To update an existing SSO configuration:

Open the sign-in method

In the Launchpad sidebar, click Sign In Methods. Select the method you want to modify.

Edit the configuration

Click Edit at the top-right of the SSO Details section. Update the configuration or attribute fields as needed, such as SP Entity ID, IdP URL, or IdP Entity ID.

Update metadata or certificate

You can upload a new metadata file to autofill the required fields, or update the signing certificate manually.

Save

Click Save to apply the changes. Click Cancel to discard them.

Once SSO is configured, users can sign in through their organization’s identity provider. There are two ways to access your workspace.

With a workspace URL

If you know your workspace URL, enter it directly in your browser (for example, companyname.kodelabs.com). The sign-in page displays your configured SSO options alongside the standard email and password login.

Sign In to KODE Labs page showing Sign in with Azure AD button, email and password fields, and an Other sign in methods option — The sign-in page shows SSO options alongside email and password login

You can sign in using one of the following options:

Click a Sign in with… button to authenticate through your IdP. If you are already signed in to your IdP, you are redirected to your workspace without additional prompts. Otherwise, you are redirected to your IdP’s sign-in page first.
Enter your email and password and click Login with Email to use your KODE OS credentials.

Azure AD errors such as AADSTS50020 usually mean the account is not in your organization directory. Personal Microsoft accounts (for example, @gmail.com via live.com) cannot use Azure AD alone. Ask your organization’s IT team to add the user as a guest in Azure AD, or sign in with the method your Launchpad administrator assigned.

Without a workspace URL

If you do not know your workspace URL, navigate to accounts.kodelabs.com. Enter your workspace domain and click Continue to reach your sign-in page.

Sign in to your workspace page with a workspace domain field showing the .kodelabs.com suffix and a Continue button — The workspace domain page lets you enter your organization's subdomain to access the sign-in page

Find your workspace

If you do not know your workspace domain, click Find your workspaces on the workspace domain page. Enter your KODE OS account email and click Continue. You receive an email with instructions to locate your workspace.

Get Started

Channel Partners

Client Organizations

Reference

Benefits of Single Sign-On

Configuration