Single Sign-On Configuration page reference
- Applies to:
- CXone Mpower Expert (current)
- Role required:
- Admin
The Single Sign-On Configuration page (Dashboard > Integrations > Single Sign-On Configuration) lists every enabled SAML and OpenID Connect (OIDC) service on your site. Use it to look up the values your identity provider (IdP) needs, to confirm what the site has stored, and to create or edit a service. This article explains each part of the page and every configuration key that appears on it.
For step-by-step instructions, see Create and manage SSO IdP services and Configure a default sign-in provider.
Who can use the page
- You must be signed in as an Admin.
- The page only appears after at least one external sign-in service (SAML, OIDC, or a custom sign-in redirect) has been set up on your site. If you don't see Single Sign-On Configuration under Integrations, contact Support to set up your first service.
Page layout
From top to bottom, the page shows:
- Default sign-in provider: a drop-down that sets which service users are sent to when they sign in. The options are Local / Native Login and each enabled service. If your site uses more than one provider and has no single default, the drop-down shows No default (multiple providers). A new selection saves as soon as you pick it.
- Create New Service: opens the form for adding a SAML 2.0 or OpenID Connect service.
- One card per enabled service. Each card shows the service description and its type (SAML 2.0 Web Browser SSO Profile or OpenID Connect 1.0 Authorization Code Flow), an Edit button, and a table of configuration keys and their current values.
Only enabled services appear on the page. If you set a service's status to Disabled, it disappears from the page and from the default sign-in provider list. You can't re-enable it from the Dashboard; you have to recreate the service.
How values are displayed
- Secrets are partly hidden. The relying party client secret and the service provider private key show only their first and last three characters, for example
abc...xyz. - Certificates appear in full, with their expiration date and time in a separate row. Check the expiration rows before a certificate expires so you have time to rotate it on both sides.
- Empty values mean the setting isn't configured. Settings marked (Optional) in the table can be left empty.
- Write-only fields on the Edit form (certificates, private key, client secret, JWKS document) never show the stored value. Leave one blank to keep the current value, or enter a new value to replace it.
Values to give your identity provider
These values are generated by the site and are read-only. Copy them into your IdP's application settings.
SAML 2.0 service provider values
| Label on the page | Key | What it's for |
|---|---|---|
| Service provider entity ID | sp-entityid | The globally unique identifier of this site for this service. Your IdP may call it the Audience URI or Identifier. |
| Service provider assertion consumer service URL | sp-url-acs | HTTP-POST endpoint that receives the SAML assertion. Your IdP may call it the Reply URL or ACS URL. |
| Service provider sign-in URL | sp-url-login | Endpoint that starts a sign-in from the site. |
| Service provider metadata download URL | sp-url-metadata | Federation metadata XML. Many IdPs can import this URL directly instead of you entering each value. |
| Service provider single logout URL | sp-url-slo | HTTP-Redirect endpoint for single logout started by either the site or the IdP. |
| Service provider X.509 certificate download URL | sp-url-x509 | Downloads the service provider certificate, if one is configured. |
OpenID Connect relying party values
| Label on the page | Key | What it's for |
|---|---|---|
| Relying party sign-in URL | rp-url-login | Endpoint that starts a sign-in from the site. |
| Relying party authorization code consumer URL | rp-url-code | The redirect (callback) URI. Register this value as an allowed redirect URI in your IdP application. |
Fields on the Create and Edit forms
Both forms start with three fields:
- Service type (Create only): SAML 2.0 or OpenID Connect. Changing the type clears the form.
- Description (required): the name admins see on this page and users see on the sign-in screen.
- Status: Enabled or Disabled. New services default to Enabled. See the note above about disabling.
The remaining fields are labeled by their configuration key. An asterisk (*) marks a required field.
SAML 2.0 fields
| Key | Name | Required | Description |
|---|---|---|---|
idp-entityid | Identity provider entity ID | Yes | Globally unique name of your IdP, often called the Issuer. |
idp-sso-url | Identity provider sign-in URL | Yes | HTTP-Redirect binding endpoint that receives the site's authentication request. |
idp-x509 | Identity provider X.509 certificate | Yes (write-only) | Public certificate used to verify that messages came from your IdP. Paste the PEM text. |
idp-slo-url | Identity provider single logout URL | No | HTTP-Redirect binding endpoint that receives the site's logout request. |
idp-sso-silent-url | Identity provider silent sign-in URL | No | Sign-in endpoint that uses the IdP's existing session cookie and doesn't show a sign-in prompt. |
sp-nameid-format | Service provider NameID format | No | Format of the NameID that identifies the user. Persistent NameIDs are strongly recommended because they keep a user's identity consistent over time. |
sp-x509 | Service provider X.509 certificate | No (write-only) | Certificate for signing requests and decrypting responses. Provide it with sp-private-key. |
sp-private-key | Service provider private signing and encryption key | No (write-only) | Private key for signing requests and decrypting encrypted assertions. Without it, the site doesn't sign requests or accept encrypted assertions. |
assertion-fullname-pattern | Assertion custom display name pattern | No | Builds the user's display name from other attributes. Put attribute names in brackets, for example [FirstName] [LastName]. |
assertion-groups-attribute | Assertion group list attribute | No | Assertion attribute that lists the user's groups to synchronize, for example http://schemas.xmlsoap.org/claims/Group. Configure the same attribute in your IdP. |
assertion-groups-delimiter | Assertion group list attribute delimiter | No | Characters that separate group names in one attribute value. For example, ,/ splits lorem,ipsum/dolor into three groups. If left empty, each attribute value is read as one group. |
assertion-groups-adfs-component | Assertion ADFS group name component | No | For Active Directory distinguished names, which component to use as the group name. For example, CN extracts Employees from CN=Employees,DC=Company,DC=com. |
assertion-groups-allowed-pattern | Assertion group list attribute allowed values pattern | No | Regular expression. Only groups that match are synchronized. |
groups-namespace-mode | Group namespace mode | No | Set to prefix or append to add a namespace to synchronized group names, so they don't conflict with groups from another IdP. |
provision-jit-enabled | JIT user provisioning | No (checkbox) | Creates a user account the first time someone signs in. On by default. |
provision-api-enabled | API user provisioning | No (checkbox) | Allows users for this service to be provisioned through the REST API. Off by default. |
oauth-consent-scopes | OAuth consent scopes | No | Permission scopes shown on the OAuth consent screen. |
OpenID Connect fields
On the Create form, an OpenID Connect service has a Discovery URL field. Enter your IdP's discovery document URL (usually ending in /.well-known/openid-configuration) and click Fetch configuration. The site then fills in idp-issuer, idp-authorize-url, idp-token-url, idp-userinfo-url, idp-keys-url, and idp-logout-url from the document. You still need to enter the client ID and client secret yourself.
| Key | Name | Required | Description |
|---|---|---|---|
rp-client-id | Relying party client ID | Yes | Client (application) ID issued by your IdP. |
rp-client-secret | Relying party client secret | Yes (write-only) | Client secret issued by your IdP. Required when you create the service. When you edit it, leave the field blank to keep the current secret. |
idp-issuer | Identity provider issuer | Yes | The IdP's issuer identifier, usually a URL. It must match the iss value in identity tokens. |
idp-authorize-url | Identity provider authorization URL | Yes | Endpoint that receives the authorization code request. |
idp-token-url | Identity provider token URL | Yes | Endpoint where the authorization code is exchanged for tokens. |
idp-token-url-auth | Identity provider token endpoint auth method | No | How the site authenticates to the token endpoint: client_secret_basic (default), client_secret_post, or client_secret_jwt. |
idp-keys-url | Identity provider JSON Web Key Set (JWKS) URL | One of these two | URL of the public key set used to verify identity tokens. Recommended, because the site picks up key rotations automatically. |
idp-jwks | Identity provider JSON Web Key Set (JWKS) | One of these two (write-only) | The public key set itself, pasted as JSON. Use this only if your IdP doesn't publish a JWKS URL. |
idp-logout-url | Identity provider logout URL | No | Endpoint that receives the site's logout request. |
idp-userinfo-url | Identity provider user information URL | No | Endpoint for fetching user claims that aren't in the identity token. |
idp-silent-authorize-url | Identity provider silent authorization URL | No | Authorization endpoint that uses the IdP's existing session cookie and doesn't show a sign-in prompt. |
scopes | Authorization request scopes | No | Scopes to request, for example profile email. The openid scope is always added for you, so you don't need to list it. |
claims-additional | Identity token additional claims | No | Comma-separated claims to read from the identity token and store in the user's session. |
claims-groups | Identity token group list claim | No | Claim that lists the user's groups to synchronize. |
claims-seat-on-name | Seat on claim name | No | Name of a claim that decides whether the user gets a seat. Use it with claims-seat-on-value. |
claims-seat-on-value | Seat on claim value | No | The user is seated when the claim named in claims-seat-on-name has this value. |
seated-users-only-enabled | Seated users only | No (checkbox) | When checked, only seated users can sign in through this service. Off by default. |
groups-namespace-mode | Group list namespace mode | No | Set to prefix or append to add a namespace to synchronized group names, so they don't conflict with groups from another IdP. |
provision-jit-enabled | JIT user provisioning | No (checkbox) | Creates a user account the first time someone signs in. On by default. |
provision-api-enabled | API user provisioning | No (checkbox) | Allows users for this service to be provisioned through the REST API. Off by default. |
oauth-consent-scopes | OAuth consent scopes | No | Permission scopes shown on the OAuth consent screen. |
service-name | Service name | No | A short name, for example my-service-name, that you can use in sign-in links in place of the service ID: /@app/auth/=my-service-name/login. |
Custom sign-in redirect services
Some older sites send users to a hosted sign-in page through a custom redirect instead of SAML or OIDC. These services appear as Custom Web Browser Redirect, show the Sign in URL (sso-login-href) and Sign out URL (sso-logout-href), and display a deprecation warning. In both URLs, $r is replaced with the address of the page to return to. We recommend moving to SAML or OpenID Connect; contact your account manager for help.