Connect Okta, Microsoft Entra, or another SAML identity provider so people sign in with their company account. Optionally turn on SCIM so that provider can create and remove Cortena users.
Company SSO is separate from Workspace login requirements. Login requirements choose which methods are allowed and how long a session lasts. Company SSO is the identity provider itself.
After users exist, assign what they can do in User management. SCIM does not assign permission groups.
1. Where to configure it
Open Settings → Integrations → Authentication → Company SSO.
The page intro is: company login is configured per workspace. A parent connection is used by child workspaces automatically. A child can add another identity provider with its own email domain.
A connection inherited from a parent is shown as Managed by that workspace, with the display name and email domains. You do not edit the parent's certificate here.
2. Add this workspace's identity provider
Under This workspace:
- Set a Display name people will recognise (for example Okta or Entra).
- In your identity provider, create a SAML application. Download Cortena metadata and upload it there, or copy Cortena's entity ID and reply URL from that file. Cortena expects the name identifier to be the person's work email, and it expects the identity provider to sign the assertion.
- Paste the identity provider's metadata XML and click Read metadata. Cortena fills Identity provider entity ID, SSO URL (https), and Signing certificate (PEM). You can type those three fields instead of pasting XML.
- Enter Email domains, comma-separated, without a path. Example:
contoso.com, contoso.de. Each domain can belong to only one company connection. That is how sign-in knows which provider to open. - Click Save.
The certificate is stored. Later the field says Certificate saved: paste a new one to replace it. Leave it empty to keep the current certificate.
Remove this connection deletes this workspace's provider. It does not remove a parent connection shown above.
Use Test login after save, before you require company login for everyone.
3. Who must use company login
Two checkboxes control enforcement. They are independent.
| Setting | Effect |
|---|---|
| Require company login for this workspace | Google, Microsoft, and email magic link no longer unlock this workspace. Child workspaces inherit this rule. |
| Only this workspace's identity provider can unlock it | This workspace ignores the parent provider. Only its own connection counts, and company login is required. |
A person who is already signed in with the wrong method sees Re-authenticate to continue and Continue with company login. They can switch to another workspace from the account menu without signing out. Other workspaces stay usable.
On the sign-in page, start with Work email. If that domain matches one connection, Cortena sends them to that provider. If several connections could apply, they choose. If company login fails, the message is Company login failed. Try again or use another sign-in method.
4. Optional user provisioning (SCIM)
SCIM is optional. Company login works without it. Use it when Okta or Entra should create and deactivate people, instead of inviting them by hand.
After the connection is saved, User provisioning (SCIM) shows:
- A base URL. Paste it into the identity provider's provisioning app. It is a SCIM 2.0 URL for this connection.
- A token, shown once in full. After that, Cortena only shows Token ending in the last characters. The provider sends it as a bearer token.
- Generate a new token if the token was lost or should be rotated. The previous token stops working. Update the identity provider in the same step.
Cortena accepts the Users resource only. It does not accept SCIM groups.
| Identity provider action | What Cortena does |
|---|---|
| Create or update a user | Adds the person to this workspace. The username must be their email. |
| Deactivate or delete a user | Removes membership that this provisioning connection granted. |
| Provision into a parent | Also adds the person to child workspaces that still have Receive users provisioned by a parent identity provider ticked. |
New provisioned users have no permission groups. Open Settings → Users and assign groups or permissions before they can work. See User management.
People you invited yourself are not removed when the identity provider deactivates someone. Only memberships that SCIM created are revoked.
Receive users provisioned by a parent identity provider is on unless you clear it. Clearing it stops this workspace from receiving the parent's SCIM users. A workspace further down the tree can still receive them if its own box stays ticked.
5. Suggested order
- Create the SAML app and save This workspace.
- Test login with a work email on one of the domains.
- If you want automatic joiners, paste the SCIM base URL and token into Okta or Entra and assign a test user. Confirm they appear, then assign their Cortena permissions.
- Turn on Require company login for this workspace only after the test succeeds.
Quick reference
| Task | Where |
|---|---|
| Connect the identity provider | Settings → Integrations → Authentication → Company SSO |
| Give Cortena's URLs to the provider | Download Cortena metadata |
| Read the provider's XML | Read metadata |
| Force company login | Require company login for this workspace |
| Ignore the parent provider | Only this workspace's identity provider can unlock it |
| Provision users | User provisioning (SCIM) · base URL and token |
| Stop inheriting parent users | Clear Receive users provisioned by a parent identity provider |