Guide›Security & compliance
Security & complianceIntermediate8 min

Set up SSO

Enable Single Sign-On so your team authenticates via your existing identity provider — Google Workspace, Microsoft Entra ID, Okta, or any SAML 2.0 / OIDC provider.

Supported protocols and providers

Myndlab supports two standard authentication protocols for SSO:

1
SAML 2.0
The most widely supported enterprise SSO standard. Compatible with any identity provider that issues SAML assertions.
2
OIDC (OpenID Connect)
A modern, OAuth 2.0-based protocol. Generally simpler to configure than SAML and preferred for cloud-native identity providers.

Providers with first-party setup guides built into the Myndlab UI:

1
Google Workspace
OIDC. Recommended for teams already on Google.
2
Microsoft Entra ID (Azure AD)
SAML 2.0 or OIDC. Recommended for Microsoft 365 organisations.
3
Okta
SAML 2.0 or OIDC. Supported via the generic SAML / OIDC flow.
4
Generic SAML 2.0
Any provider that issues SAML assertions — JumpCloud, OneLogin, Ping Identity, and others.

Where to configure SSO

SSO is configured per-project and requires the Admin role. Navigate to Project Settings › Auth › SSO to reach the configuration panel.

SSO is available on the Business and Enterprise plans. If the SSO tab is not visible, check your plan in Project Settings › Billing.

Google Workspace setup

1
Select Google Workspace in the SSO panel
In Project Settings › Auth › SSO, click "Add provider" and choose Google Workspace.
2
Create an OAuth 2.0 client in Google Cloud Console
Go to APIs & Services › Credentials › Create Credentials › OAuth client ID. Set Application type to Web application. Add the Redirect URI shown in the Myndlab SSO panel.
3
Copy the Client ID and Client Secret
Paste both values into the corresponding fields in the Myndlab SSO panel.
4
Set the allowed domain
Enter your Google Workspace domain (e.g. yourcompany.com) so only users in your organisation can sign in.
5
Save and test
Click Save, then click "Test connection" to confirm authentication works before enabling SSO for the team.

Microsoft Entra ID setup

1
Register an application in Entra ID
In the Azure portal, go to Microsoft Entra ID › App registrations › New registration. Set the redirect URI to the value shown in the Myndlab SSO panel.
2
Generate a client secret
Under Certificates & secrets, add a new client secret. Copy the value immediately — it is only shown once.
3
Copy the Application (client) ID and Directory (tenant) ID
Both are on the app registration overview page.
4
Paste into Myndlab
Enter the Client ID, Client Secret, and Tenant ID into the Myndlab SSO panel and click Save.
5
Assign users or groups
In Entra ID, under the app registration › Users and groups, assign the users or security groups that should have access to Myndlab.

Generic SAML setup

For any SAML 2.0-compatible provider, Myndlab exposes the following endpoints and identifiers:

text
ACS URL (Assertion Consumer Service):
  https://app.myndlab.com/auth/saml/callback

Entity ID (Service Provider):
  https://app.myndlab.com/auth/saml/metadata

Configure these in your identity provider, then paste the IdP metadata URL (or upload the metadata XML) into the Myndlab SSO panel. Required attribute mappings:

text
email   → user's email address (required)
name    → user's display name (optional, recommended)
role    → user's role in Myndlab (optional — see Role mapping below)

Role mapping

You can map IdP groups or SAML attributes to Myndlab roles, so team members automatically receive the correct permissions on sign-in:

1
Admin
Full access to all project settings, billing, and team management.
2
Editor
Can create and run builds, view version history, and edit environment variables.
3
Viewer
Read-only access to the Build screen and project settings.

Role mapping rules are configured in the Myndlab SSO panel under Role mapping. Enter the group name or attribute value from your IdP and select the corresponding Myndlab role.

Users who do not match any mapping rule are assigned the Viewer role by default.

Testing SSO before enforcing

After saving your SSO configuration, use the Test connection button in the Myndlab SSO panel to verify the integration. This opens a browser pop-up that walks through the full authentication flow without affecting your current session.

💡
Tip.Test SSO with at least one other team member's account before enabling "Enforce SSO". Locking yourself out of the project requires a support email to recover — there is no self-serve bypass once SSO is enforced.

Enforcing SSO

Once you are confident SSO is working, toggle Enforce SSO in the SSO panel. From that point:

1
Password login is disabled for team members
Users with Viewer, Editor, or Admin roles must authenticate via the configured identity provider. Email/password and magic-link flows are blocked.
2
The project owner is exempt
The account that owns the Myndlab project retains password login as a break-glass mechanism, regardless of enforcement.
3
New invitations go through SSO
Inviting a team member sends them a link that initiates the SSO flow rather than prompting for a password.