> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.kodelabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure Single Sign-On (SSO)
> Set up SSO with OIDC or SAML
SSO lets users sign in to Launchpad through their organization's identity provider instead of separate KODE Labs credentials. Launchpad supports OIDC and SAML, with pre-built integrations for several identity providers. You configure sign-in methods from **Sign In Methods** in the sidebar.
## Benefits of Single Sign-On
SSO simplifies the sign-in experience by eliminating the need to manage separate credentials for each platform. Users authenticate once through their organization's identity provider and gain access to Launchpad and other connected applications without repeated logins. This reduces password-related support requests and frees IT teams to focus on higher-priority work.
* Centralized authentication through your existing identity provider
* Reduced credential fatigue, as users rely on one set of credentials across platforms
* Stronger security posture by enforcing your organization's authentication policies
* Simplified user management, with user provisioning and de-provisioning handled through your IdP
* Fewer password-related support tickets for IT teams
## Supported Sign-in Methods
Launchpad supports SSO through the following authentication protocols.
* **OpenID Connect (OIDC)** -- a modern authentication protocol commonly used for web and mobile applications.
* **Security Assertion Markup Language (SAML)** -- an XML-based protocol widely adopted for enterprise SSO across web applications.
KODE Labs has integrated with the following identity providers:
* `CyberArk`
* `Azure Active Directory (Azure AD)`
* `Okta`
* `Auth0`
* `JumpCloud`
You can also configure a custom OIDC or SAML integration with any IdP that supports these protocols.
## Configuration
Setting up SSO requires configuring a sign-in method in Launchpad and connecting the corresponding application in your identity provider. You complete both from a single form in Launchpad. Click `+ Add Sign in Method` to choose a protocol or pre-built template.
Before you begin, verify that you have an admin role in your Launchpad workspace and access to your identity provider's configuration settings.
In the Launchpad sidebar, click **Sign In Methods**, then click **+ Add Sign in Method**. Select one of the pre-configured identity providers that uses OIDC, or choose a custom OIDC configuration if your provider is not listed.
Launchpad generates an **Authentication Callback URL** at the top of the form. Copy this value -- you need to enter it in your IdP as the Redirect URL or Callback URL.
The callback endpoint your IdP redirects users to after authentication. This value is auto-generated and read-only.
In the **Sign In Method Name** field, enter a unique name for this method. You can optionally upload an IdP picture.
The sign-in method name cannot be changed after you save it.
Log in to your identity provider and create a new application for KODE Labs. Provide the Authentication Callback URL you copied from Launchpad. After configuring the application, your IdP provides the values needed for the next step.
Back in the Launchpad form, enter the following values from your IdP:
The OpenID Connect discovery endpoint provided by your IdP (typically ending in `/.well-known/openid-configuration`).
The unique identifier your IdP assigned to the KODE Labs application.
The secret key your IdP generated for this application.
Under **Claim configuration for email**, verify that the **Email** field is set to the claim your IdP uses for email addresses (defaults to `email`).
Optionally check **Set as default Sign In Method** if you want this to be the primary sign-in option for your organization. Click **Save**.
In the Launchpad sidebar, click **Sign In Methods**, then click **+ Add Sign in Method**. Select one of the pre-configured identity providers that uses SAML, or choose a custom SAML configuration if your provider is not listed.
Launchpad generates several values at the top of the form. Copy or download these -- you need them when configuring the application in your IdP.
The endpoint where your IdP sends SAML responses after authentication. Copy this into your IdP's ACS URL field.
The service provider certificate (`x509Certificate.pem`). Click **Download** to save it.
In the **Sign In Method Name** field, enter a unique name for this method. You can optionally upload an IdP picture.
The sign-in method name cannot be changed after you save it.
The following fields are pre-configured in Launchpad and must match the corresponding values in your IdP:
The unique identifier for Launchpad as a service provider.
The format used to identify users. Pre-set to EmailAddress.
The algorithm used to sign SAML assertions. Pre-set to RSA-SHA256.
The transport method for SAML messages. Pre-set to HTTP-POST.
When enabled, Launchpad signs outgoing SAML requests. Disabled by default.
Log in to your identity provider and create a new application for KODE Labs. Provide the Assertion Consumer Service URL, SP Entity ID, NameID Format, Signature Algorithm, and Protocol Binding values from the Launchpad form. Configure attribute mapping in your IdP for `firstName`, `lastName`, and optionally `roles` to synchronize role assignments.
Back in the Launchpad form, you can either upload a metadata XML file to autofill the fields below, or enter them manually:
Upload your IdP's metadata XML file to autofill the IdP URL, IdP Entity ID, and Certificate fields.
The SSO endpoint provided by your IdP for SAML authentication.
The unique identifier for your identity provider.
The public certificate your IdP uses to sign SAML assertions. Upload a `.pem` or `.der` file.
Under **Claim configuration for email**, enter the attribute your IdP uses for email addresses in the **Email** field.
Optionally check **Set as default Sign In Method** if you want this to be the primary sign-in option for your organization. Click **Save**.
## Role mapping
With SSO enabled, you can pass user roles from your identity provider to KODE OS automatically. This means user permissions are managed in your IdP rather than individually in Launchpad. Role mapping is optional -- you can always set user permissions directly in KODE OS regardless of how users authenticate.
Role mapping requires attribute configuration in both your IdP and Launchpad. Before you configure role mappings, add the roles attribute in the Attribute Mappings section of your IdP and return the information in KODE Labs.
To configure role mapping, open the sign-in method in Launchpad and configure the following options:
Allows automatic user creation on first login. When enabled, configure the `First Name` attribute, `Last Name` attribute, and `Roles` attribute that your IdP returns.
Sets a fallback role for users who do not have a role mapped in this sign-in method. You can add additional roles after you save the sign-in method.
When enabled, existing roles assigned to users in Launchpad are overridden by the roles assigned to their IdP groups on each login.
When enabled, allows access to the site map. You can add additional site mappings after you save the sign-in method.
After you enable IdP role mapping, role management for users of that IdP is handled from your IdP instead of from Launchpad. You can manage your role mappings by adding the ability to create, update, and assign users to buildings on sign-in.
### Attribute mapping
Under Attribute Mapping in your IdP, add the following attributes. If you want to map IdP groups or roles to KODE OS roles, add a `roles` attribute and return your IdP users' roles or groups to Launchpad.
* **SAML IdP**: `firstName` attribute, `lastName` attribute, `roles` attribute
* **OIDC IdP**: `firstName` claim, `lastName` claim, `roles` claim
## Edit SSO configuration
To update an existing SSO configuration:
In the Launchpad sidebar, click **Sign In Methods**. Select the method you want to modify.
Click `Edit` at the top-right of the SSO Details section. Update the configuration or attribute fields as needed, such as `SP Entity ID`, `IdP URL`, or `IdP Entity ID`.
You can upload a new metadata file to autofill the required fields, or update the signing certificate manually.
Click `Save` to apply the changes. Click `Cancel` to discard them.
## Sign in with SSO
Once SSO is configured, users can sign in through their organization's identity provider. There are two ways to access your workspace.
### With a workspace URL
If you know your workspace URL, enter it directly in your browser (for example, `companyname.kodelabs.com`). The sign-in page displays your configured SSO options alongside the standard email and password login.
You can sign in using one of the following options:
* Click a **Sign in with...** button to authenticate through your IdP. If you are already signed in to your IdP, you are redirected to your workspace without additional prompts. Otherwise, you are redirected to your IdP's sign-in page first.
* Enter your email and password and click `Login with Email` to use your KODE OS credentials.
Azure AD errors such as `AADSTS50020` usually mean the account is not in your organization directory. Personal Microsoft accounts (for example, `@gmail.com` via `live.com`) cannot use Azure AD alone. Ask your organization's IT team to add the user as a guest in Azure AD, or sign in with the method your Launchpad administrator assigned.
### Without a workspace URL
If you do not know your workspace URL, navigate to `accounts.kodelabs.com`. Enter your workspace domain and click `Continue` to reach your sign-in page.
### Find your workspace
If you do not know your workspace domain, click **Find your workspaces** on the workspace domain page. Enter your KODE OS account email and click `Continue`. You receive an email with instructions to locate your workspace.
