SAML single sign-on
Configure SAML 2.0 SSO with Okta, Microsoft Entra ID, Google Workspace, or any SAML identity provider, and enforce it for your organization.
With single sign-on, people sign in to Nucleus OS with their company identity, and access follows your identity provider (IdP) instead of separate passwords.
Requirements
- An admin role in Nucleus OS
- Admin access to your IdP (Okta, Microsoft Entra ID, Google Workspace, or any SAML 2.0 provider)
- The email domain(s) your people sign in with
Setup
Start the SSO setup in Nucleus OS
In your workspace security settings, choose to add a SAML identity provider. Nucleus OS shows the Assertion Consumer Service (ACS) URL and Entity ID (audience URI) your IdP needs.
Create the application in your IdP
Create a new SAML 2.0 application and enter the ACS URL and Entity ID from the previous step.
Configure attributes
Send at least these attributes in the assertion:
| Attribute | Value |
|---|---|
NameID | The user's work email (format: email address) |
email | Work email |
firstName | Given name |
lastName | Family name |
Give Nucleus OS the IdP details
Paste your IdP's SSO URL, Entity ID (issuer), and signing certificate, or upload the IdP metadata XML.
Test, then enforce
Test the connection with a non-admin account assigned to the app. When it works, enforce SSO for your domain so password sign-in is disabled for your users.
Keep a way back in
Before enforcing SSO, confirm at least two admins can sign in through the IdP. If your IdP has an outage or a certificate expires, you will need an admin who can reach support or update the configuration.
Provider notes
Create an app integration with SAML 2.0 as the sign-in method. Set Name ID format to EmailAddress and Application username to Email. Assign the app to the groups who should have access.
Certificate rotation
IdP signing certificates expire. Add the new certificate in Nucleus OS before the old one expires, then switch your IdP over. Sign-ins fail if the certificates do not match.
Next step
Pair SSO with SCIM provisioning so accounts are created and removed automatically.