Home / Help centre / Workspace settings
Workspace settings
How do I set up single sign-on with my identity provider?
Open Settings, choose Single sign-on, then enter your provider's Issuer URL, Client ID and Client secret. Copy the Redirect URI into your identity provider. Save, tick Enable single sign-on and save again. Any OpenID Connect provider works.
Steps
Cyberlop speaks OpenID Connect, so most identity providers fit. It reads its settings from the issuer's discovery document.
STEPSFields
Each field has a clear job.
| Field | What to enter |
|---|---|
| Issuer URL | Your provider's issuer address, for example https://idp.example.com |
| Client ID | The ID your provider gave the Cyberlop app |
| Client secret | The secret for that app |
| Redirect URI | Copy this into your provider. Do not change it. |
Good to know
People are matched to Cyberlop accounts by their verified identity. Require an admin-bound SSO subject is on by default and is the recommended choice. An admin sets each person's immutable subject before their first sign-in, which closes the window that email-based matching leaves open.
You can also let new people in without an admin step. See how to create accounts automatically. For the redirect value, read where to find it.
With SSO, two-factor checks come from your identity provider. Cyberlop leaves them to that side.
Setting the subject for each person happens under Administration, which only admins see. Its steps live in the app, so ask on the contact page if you need help with that step.
Run a first test with one person before you roll it out. Ask them to sign in through your provider, and keep a second admin session open so that nobody gets locked out if a setting is wrong. Local sign-in still exists for people who have a password. Then announce the change to the rest of the team once you have seen it work end to end, with a short note on where to go for help.
Related questions
- Where do I find the redirect URI to give my identity provider?
- How do I let new people get accounts automatically through SSO?
- What does "Require an admin-bound SSO subject" do?
- Which identity providers work with Cyberlop single sign-on?
- How do I make two-factor authentication mandatory for my workspace?
Single sign-on: set up OIDC, the redirect URI and account binding
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.