Enterprise Single Sign-On (SSO) Setup
Aigenzey Cowork provides native Single Sign-On (SSO) integration for Business & Enterprise customers. Centralize employee authentication, enforce identity policies, and automatically onboard team members using your existing corporate Identity Provider (IdP).
Enterprise Single Sign-On is available for all Business & Enterprise workspaces. Personal individual accounts use standard Google authentication.
SSO Overview & Architecture
When configured, employees sign in via your company's dedicated portal or via the Business Login page by entering their corporate email address. Cowork identifies their organization domain and redirects them to your Identity Provider for seamless, multi-factor authentication.
- Standard Protocols: Supports OpenID Connect (OIDC 1.0) and SAML-compatible federation bridges.
- Zero Password Storage: Cowork never stores or handles corporate passwords; authentication is validated via signed JWT tokens directly from your IdP.
- Granular Role Mapping: New users are automatically provisioned and assigned to their respective departments with appropriate permissions.
Authorized Callback URI
When registering your Cowork application inside your Identity Provider's developer or admin console, enter the following Redirect / Callback URI:
https://cowork.aigenzey.com/auth/sso/callbackIdentity Provider Setup Guides
Navigate to Admin Panel → Settings → Single Sign-On in your Cowork workspace to configure your provider:
1. Microsoft Entra ID (formerly Azure Active Directory)
| Setting Field | Description & Example |
|---|---|
| Provider Type | Select Microsoft Entra ID |
| Tenant ID | Your Azure Directory (tenant) ID GUID, e.g. 8f123456-789a-bcde-f012-3456789abcde |
| Client ID | Application (client) ID assigned in Azure App Registrations |
| Client Secret | Value of the client secret generated in Azure Certificates & Secrets |
Azure Portal Configuration Steps:
- Sign in to the Azure Portal and navigate to Microsoft Entra ID → App registrations → New registration.
- Select Web as the platform and enter the Redirect URI:
https://cowork.aigenzey.com/auth/sso/callback. - Under API permissions, ensure Microsoft Graph
User.Read(Delegated) permission is added and granted admin consent. - Under Certificates & secrets, create a new Client Secret and copy its value.
- Enter the Tenant ID, Client ID, and Client Secret into Cowork Admin Panel.
2. Google Workspace SSO
| Setting Field | Description & Example |
|---|---|
| Provider Type | Select Google Workspace |
| Client ID | OAuth 2.0 Web Client ID from Google Cloud Console |
| Client Secret | Client Secret from Google Cloud Console |
| Allowed Domains | Corporate Google Workspace email domain (e.g. acme.com) |
Google Cloud Console Steps:
- Open the Google Cloud Console → APIs & Services → Credentials.
- Create an OAuth 2.0 Client ID with application type Web application.
- Add
https://cowork.aigenzey.com/auth/sso/callbackunder Authorized redirect URIs. - Save and enter the Client ID and Secret in your Cowork Admin Panel.
3. Okta OIDC
| Setting Field | Description & Example |
|---|---|
| Provider Type | Select Okta |
| Issuer URL | Your Okta organization domain, e.g. https://acme.okta.com |
| Client ID | Client ID generated in Okta Application settings |
| Client Secret | Client Secret generated in Okta Application settings |
Okta Admin Steps:
- In the Okta Admin Console, navigate to Applications → Create App Integration.
- Select OIDC - OpenID Connect and application type Web Application.
- Under Sign-in redirect URIs, add
https://cowork.aigenzey.com/auth/sso/callback. - Set Assignments to your desired user groups and save. Copy the Issuer URL, Client ID, and Secret to Cowork.
4. Generic OIDC (Auth0, PingIdentity, OneLogin, Keycloak)
Any standard OpenID Connect 1.0 certified provider that exposes a discovery document (/.well-known/openid-configuration) can be connected:
- Issuer URL: Base URL of your OIDC authorization server (e.g.
https://auth.company.comorhttps://company.us.auth0.com). - Client ID / Secret: Credentials provisioned by your OIDC identity server.
- Scopes Requested:
openid,profile,email.
Governance, JIT & Enforcement Policies
Domain Whitelisting (allowed_domains)
Define the specific email domain suffixes allowed to authenticate into your organization (e.g. acme.com, engineering.acme.com). Attempts to authenticate with unauthorized email domains are rejected at the callback handler.
Just-In-Time (JIT) Auto-Provisioning
When Auto-provision users is enabled, employees logging in via corporate SSO for the first time automatically have an active Cowork account created. They do not need to wait for an administrator invite link.
Default Roles & Departments
Configure the baseline access tier for newly onboarded team members:
- Default Role: Typically set to
Member. - Default Departments: Automatically enroll new users into initial department groups (e.g. General, All-Hands, Product) to immediately give them access to team skills and shared tools.
Enforcing Mandatory SSO
Once configuration has been tested, check Enforce SSO in the Admin Panel. When enabled:
- Direct password logins and personal OAuth options are disabled for users with corporate email domains.
- Employees visiting Cowork are automatically routed through your identity provider.
Safe Testing Flow
Always click Test SSO Configuration prior to enabling mandatory enforcement. The test probe executes an ephemeral authentication cycle and validates token decoding, email claims, and domain matching without updating your live session.
Security & Credential Encryption
- Encrypted Secrets: All IdP client secrets are encrypted using AES-128-CBC and HMAC-SHA256 authenticated Fernet cryptography at rest in the database.
- Signed State Parameters: Authentication redirects include cryptographically signed, timestamped state tokens with a strict 10-minute validity window to prevent replay and CSRF attacks.
- Session Lifecycle: SSO sessions respect your organization's token expiration and revocation policies.