Single Sign-On (SSO)

Path: /admin/iam → SSO · Sidebar: Administration → Identity & Access

Connect apPosture to your identity provider so users sign in with corporate credentials, with roles mapped from IdP groups.

Supported protocols

• SAML 2.0 - Okta, Azure AD / Entra ID, Google Workspace, PingFederate, ADFS.
• OIDC / OAuth2 - any OpenID Connect provider.

Configure

1. In your IdP, create an application for apPosture and note the metadata URL (SAML) or issuer / client id / secret (OIDC).
2. In Identity & Access → SSO, choose the protocol and paste the IdP details.
3. Set the ACS / redirect URL shown by apPosture back in your IdP.
4. Test the connection, then enable it.

Role mapping

Map IdP groups / claims to apPosture RBAC roles so access is governed centrally:

• appsec-leads → AppSec Lead
• auditors → Auditor
• default → Viewer

Unmapped users land on the least-privilege default role.

Provisioning & security

• Just-in-time provisioning - a user is created on first successful SSO login with the mapped role.
• MFA can be enforced at the IdP and/or in apPosture.
• SSO does not replace API tokens - those stay for programmatic/CI access.

Keep a break-glass admin

Keep one local admin account (with MFA) so you can recover access if the IdP connection breaks.