Home / Help centre / Workspace settings
Workspace settings
What does "Require an admin-bound SSO subject" do?
An admin must record a person's immutable SSO subject before that person signs in for the first time. It also turns off the verified-email bootstrap, which closes the nOAuth account-binding window. It is the recommended setting, and it comes ticked by default.
The short version
The option makes an admin tie each person to a fixed identity before that person signs in with single sign-on for the first time. The box is the recommended choice, and it comes ticked. Leave it on unless you have a clear reason not to, and let your security team make that call.
How it works in Cyberlop
Every sign-in from your identity provider carries a subject. That is an identifier the provider gives a person and never changes, unlike an email address, which people can edit. With Require an admin-bound SSO subject ticked, an admin must record that subject on the user before the first login. No subject, no entry.
This also switches off the verified-email bootstrap. Without it, Cyberlop could link a new sign-in to an account by trusting an email that the provider reports as verified. Switching the bootstrap off closes what the setting text calls the nOAuth account-binding window.
| Setting | First sign-in works when |
|---|---|
| Ticked (recommended) | An admin has set the person's subject beforehand |
| Unticked | Cyberlop can match the person by a verified email |
You find the setting on Settings → Single sign-on. Your admin sets the subject on the person's account, and the app shows that step. Stuck? Ask us through the contact page.
What to do next
Keep it ticked and plan the first sign-in of each new person. Ask the admin to bind the subject first. The Cyberlop account has to exist as well. A short check before each newcomer's first day, covering both the account and the bound subject, saves a support call later. If a newcomer hits a block, read why a new SSO user cannot sign in.
To set up the rest of single sign-on, follow how to set up single sign-on. For hands-off accounts, see automatic account creation.
Related questions
- How do I set up single sign-on with my identity provider?
- Why can't a new SSO user sign in for the first time?
- How do I let new people get accounts automatically through SSO?
- Which identity providers work with Cyberlop single sign-on?
- Why can't I tick "Enable single sign-on"?
Single sign-on: set up OIDC, the redirect URI and account binding
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.