CognethicsCognethicsDevelopers

Enterprise Authentication

Cognethics supports SAML 2.0 single sign-on, SCIM 2.0 user and group provisioning, and OpenID Connect 1.0 federation for enterprise tenants. Integrate with Okta, Azure AD, Auth0, Google Workspace, OneLogin, and any other compliant identity provider for seamless workforce authentication and user lifecycle management.

Features

  • SAML 2.0 SSO — Service provider (SP) initiated or identity provider (IdP) initiated flows
  • OpenID Connect 1.0 federation — Authorization-code flow with PKCE against any OIDC-compliant IdP
  • Per-tenant IdP configuration — Multiple IdPs per tenant with email-domain-based routing
  • Customizable attribute / claim mapping — Map IdP attributes and OIDC claims to user fields (email, name, roles, organizations)
  • Automatic user provisioning — Users created/updated on first SSO login
  • SCIM 2.0 provisioning — RFC 7644 compliant user and group provisioning from your IdP
  • Multi-domain SSO routing — Route users to different IdPs based on email domain
  • Comprehensive audit logging — Track all SSO, SLO, and provisioning events

Supported Identity Providers

  • Okta — SAML 2.0 SP, OIDC, and SCIM 2.0
  • Azure AD / Microsoft Entra ID — SAML 2.0 SP, OIDC, and SCIM 2.0
  • Auth0 — OIDC and SCIM 2.0
  • Google Workspace — OIDC and SCIM 2.0
  • OneLogin — SAML 2.0 SP, OIDC, and SCIM 2.0
  • Generic SAML 2.0 IdP — Any IdP supporting SAML 2.0 Web SSO profile
  • Generic OIDC provider — Any IdP supporting OpenID Connect 1.0 Discovery (.well-known/openid-configuration)
  • Generic SCIM 2.0 provider — Any system that supports SCIM 2.0

Protocols

Getting Started

  1. Choose your protocol — SAML for IdPs with rich attribute mapping, OIDC for modern PKCE-secured flows, SCIM for automated user lifecycle.
  2. Register Cognethics with your IdP using the per-tenant metadata or discovery information published on the protocol pages above.
  3. Configure attribute / claim mapping, SSO domain routing, and group → role assignments.
  4. Roll out to your users.

Security Properties

  • Server-to-server token exchange — Authorization codes are exchanged server-to-server; access tokens never appear in URLs or browser history
  • PKCE on every OIDC flow — RFC 7636 S256 code challenge for every authorization-code exchange
  • Per-IdP JWKS validation — OIDC ID tokens are signature-validated against the IdP's JWKS endpoint with automatic key rotation
  • Encrypted signing keys and client secrets — SAML signing keys and OIDC client secrets are stored encrypted at rest
  • RFC 7644 SCIM compliance — Full SCIM 2.0 spec implementation with bearer-token authentication and audit trails
  • Audit logging — Every SSO login, SSO failure, logout, user creation, and provisioning event is logged with timestamps, IP addresses, and IdP claims

Compliance & Standards

  • SAML 2.0 (OASIS Web SSO Profile)
  • OpenID Connect 1.0 (Core + Discovery + RP-Initiated Logout)
  • OAuth 2.0 (RFC 6749) + PKCE (RFC 7636)
  • SCIM 2.0 (RFC 7644)
  • OAuth 2.0 server-to-server handoff (prevents token leakage)