Single Sign-On (SSO)
Set up sign-in with your company account.
For your company’s IT: this is how you connect your identity provider to the KI-Denkraum via SAML 2.0. Your colleagues then sign in with their company account, without a password of their own. Setting it up takes about 30 minutes.
The values you enter
| Entity ID (identifier) | https://auth.kidenkraum.com/auth/v1/sso/saml/metadata |
|---|---|
| Reply URL (ACS) | https://auth.kidenkraum.com/auth/v1/sso/saml/acs |
| Sign-on URL | https://kidenkraum.com/en/firmenkonto?domain=<your-domain.com> |
| NameID | Persistent format; with Entra ID the default will do |
| Attributes | Email address (required), first name, last name |
In the sign-on URL, replace <your-domain.com> with your domain. With it, the tile in Entra ID and Okta starts the sign-in on our side directly.
Microsoft Entra ID
- “Enterprise applications” → “New application” → “Create your own application” (not from the gallery), name “KI-Denkraum”.
- “Single sign-on” → “SAML”: enter the identifier, reply URL and sign-on URL from the table. Relay state and logout URL stay empty.
- “Attributes & Claims”: leave the defaults.
- “Users and groups”: assign the people or groups who use the KI-Denkraum; members of your tenant only, no guest accounts.
- Under “SAML Certificates”, copy the “App Federation Metadata Url” and send it to us.
Google Workspace
- Admin console → “Apps” → “Web and mobile apps” → “Add app” → “Add custom SAML app”, name “KI-Denkraum”.
- Download the IdP metadata; you send us the file.
- Enter the ACS URL and entity ID from the table, name ID format “PERSISTENT”. Leave the start URL empty.
- “Attribute mapping”: Primary email → email, First name → firstName, Last name → lastName.
- “User access”: turn it on for the organisational units or groups who use the KI-Denkraum.
- Google’s tile leads to our page, where the person enters their address. A bookmark with the sign-on URL, for example a managed bookmark in Chrome, starts the sign-in directly.
Okta
- “Applications” → “Create App Integration” → “SAML 2.0”, name “KI-Denkraum”.
- “Single sign-on URL” is the reply URL, “Audience URI (SP Entity ID)” the entity ID from the table; “Name ID format” “Persistent”.
- “Attribute Statements”: email = user.email, firstName = user.firstName, lastName = user.lastName.
- “Assignments”: assign the people or groups who use the KI-Denkraum.
- For the tile: set “Do not display application icon to users” on the SAML app and create and assign a “Bookmark App” with the sign-on URL.
- Under “Sign On”, copy the “Metadata URL” and send it to us.
What you send us
The metadata URL (Entra ID, Okta) or the metadata file (Google Workspace) and every domain of your addresses, subdomains included. We set up the connection and get in touch for a test with one person.
If you wish, your colleagues then sign in only through the company account.
Good to know
- NameID: With Entra ID it is a persistent identifier, so an account stays the same when an address changes. With Google Workspace and Okta it is usually the address: if one changes, the next sign-in creates a new account.
- Signing out: Signing out of the company account does not end the session in the KI-Denkraum.
- Leavers: A block in the company account applies at the next sign-in. A running session ends when the person signs out or after 90 days without a visit; if it should end at once, write to us.
- Certificate: Let us know when you switch it and we take over the new one at once. Otherwise we fetch it for Entra ID and Okta through the metadata URL within a day; with Google Workspace we need the new file.